CVE-2020-25276: High severity ejbca vulnerability
An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is performed on that certificate. This vulnerability can only affect a system that has EST configured, uses client certificates to authenticate enrollment, and has had such a certificate revoked. This certificate needs to belong to a role that is authorized to enroll new end entities. (To completely mitigate this problem prior to upgrade, remove any revoked client certificates from their respective roles.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25276?
The severity of CVE-2020-25276 is considered high due to the lack of revocation checks for client certificates.
How do I fix CVE-2020-25276?
To fix CVE-2020-25276, upgrade EJBCA to version 7.4.1 or later, which includes the necessary revocation checks.
What systems are affected by CVE-2020-25276?
CVE-2020-25276 affects PrimeKey EJBCA versions 6.x and 7.x prior to 7.4.1 when using EST configured systems with client certificates.
What impact does CVE-2020-25276 have on system security?
CVE-2020-25276 can potentially allow unauthorized access to a system without proper certificate validation, posing a security risk.
Can CVE-2020-25276 be exploited remotely?
Yes, CVE-2020-25276 can be exploited remotely if the target system uses the EST protocol and does not perform revocation checks.