CVE-2021-40089: Low severity PrimeKey EJBCA vulnerability
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Verify and keep the System Configuration setting "Enable External Script Access" disabled; the issue described is that General Purpose Custom Publisher could still run when this setting was disabled.
PrimeKey EJBCA Enable External Script Access = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40089?
CVE-2021-40089 is classified as a high severity vulnerability due to its potential to allow unauthorized script execution.
How do I fix CVE-2021-40089?
To fix CVE-2021-40089, upgrade EJBCA to version 7.6.0 or later where the vulnerability has been addressed.
What does CVE-2021-40089 affect?
CVE-2021-40089 affects PrimeKey EJBCA versions prior to 7.6.0 specifically related to the General Purpose Custom Publisher.
What are the risks of leaving CVE-2021-40089 unpatched?
Leaving CVE-2021-40089 unpatched may allow attackers to execute scripts without authorization, potentially compromising system integrity.
Who is impacted by CVE-2021-40089?
Organizations using PrimeKey EJBCA versions before 7.6.0 are impacted by CVE-2021-40089 and should take immediate action to mitigate the risk.