CVE-2023-34196

Опубликовано: 03 авг. 2023

Источник: nvd

CVSS3: 8.2

EPSS Низкий

Описание

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.

Ссылки

https://keyfactor.com
Product
https://support.keyfactor.com/hc/en-us/articles/16671824556827-EJBCA-Security-Advisory-Partial-denial-of-service-attack-on-certificate-distribution-servlet-ejbca-ra-cert
Mitigation
Vendor Advisory
https://keyfactor.com
Product
https://support.keyfactor.com/hc/en-us/articles/16671824556827-EJBCA-Security-Advisory-Partial-denial-of-service-attack-on-certificate-distribution-servlet-ejbca-ra-cert
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:keyfactor:ejbca:*:*:*:*:*:*:*:*

Версия до 8.0.0 (исключая)

EPSS

Процентиль: 23%

0.00076

Низкий

8.2 High

CVSS3

Дефекты

CWE-287

Связанные уязвимости

GHSA-hxcm-7rgp-cmh6