Vulnerability Description
An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain security model, the peer connector allows the restriction of client certificates (for the RA, not the end user) to a limited set of allowed CAs, thus restricting the accessibility of that RA to the rights it has within a specific role. While this works for other protocols such as CMP, it was found that the EJBCA enrollment over an EST implementation bypasses this check, allowing enrollment with a valid client certificate through any functioning and authenticated RA connected to the CA. NOTE: an attacker must already have a trusted client certificate and authorization to enroll against the targeted CA.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Primekey | Ejbca | < 7.4.3 |
Related Weaknesses (CWE)
References
- https://support.primekey.com/news/posts/40Vendor Advisory
- https://support.primekey.com/news/posts/40Vendor Advisory
FAQ
What is CVE-2020-28942?
CVE-2020-28942 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain security model, the peer connector allows the re...
How severe is CVE-2020-28942?
CVE-2020-28942 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-28942?
Check the references section above for vendor advisories and patch information. Affected products include: Primekey Ejbca.