1. Home
  2. CVE Database
  3. CVE-2021-40087
LOW · 2.7

CVE-2021-40087

An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were ...

Vulnerability Description

An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.

CVSS Score

2.7

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PrimekeyEjbca< 7.6.0

Related Weaknesses (CWE)

CWE-312

References

FAQ

What is CVE-2021-40087?

CVE-2021-40087 is a vulnerability with a CVSS score of 2.7 (LOW). An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were ...

How severe is CVE-2021-40087?

CVE-2021-40087 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-40087?

Check the references section above for vendor advisories and patch information. Affected products include: Primekey Ejbca.