CVE-2020-11629: High severity ejbca vulnerability
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to the CA UI could exploit this to upload malicious scripts to the server. (Risks associated with this issue alone are negligible unless a malicious user already has gained access to the CA UI through other means, as a trusted user is already trusted to upload scripts by virtue of having access to the validator.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11629?
CVE-2020-11629 has been classified as a medium severity vulnerability due to its potential impact on the confidentiality of sensitive certificate validation.
How do I fix CVE-2020-11629?
To mitigate CVE-2020-11629, upgrade EJBCA to version 6.15.2.6 or 7.3.1.2 or later.
What versions of EJBCA are affected by CVE-2020-11629?
CVE-2020-11629 affects EJBCA versions prior to 6.15.2.6 and versions in the 7.x series up to 7.3.1.2.
What is the impact of CVE-2020-11629 on server security?
The impact of CVE-2020-11629 can allow unauthorized access to sensitive test certificates on the server, posing a risk to overall security.
Who should be concerned about CVE-2020-11629?
Administrators using EJBCA versions earlier than the patched releases should be particularly concerned about CVE-2020-11629.