CVE-2020-36127: Medium severity paxstore vulnerability
Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be accessed by non-administrator users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36127?
CVE-2020-36127 has been classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2020-36127?
To mitigate CVE-2020-36127, upgrade PaxStore to a version higher than 7.0.8_20200511171508.
What is the impact of CVE-2020-36127?
CVE-2020-36127 could allow unauthorized access to sensitive information, specifically the p12 certificate and password for administrators.
Who is affected by CVE-2020-36127?
All administrators using Pax Technology PaxStore version 7.0.8_20200511171508 and lower are affected by CVE-2020-36127.
Is there a workaround for CVE-2020-36127?
Currently, the recommended and effective approach for CVE-2020-36127 is to upgrade to a patched version of PaxStore.