CVE-2021-40086 Information disclosure in n/a
Administrators can view the enrollment secret in page source, exposing sensitive configuration data to those with admin access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40086?
CVE-2021-40086 is a low-severity vulnerability in n/a, published on 25 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page (that can only be viewed by an administrator). While hidden from direct view, checking the page source would reveal the secret.
Weakness: CWE-200
Which versions are affected by CVE-2021-40086?
1 open source package ship an affected version, including ejbca. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ejbca Bitnami | All versions | 7.6.0 |
Products include Primekey Ejbca.
How do I fix CVE-2021-40086?
Upgrade ejbca to 7.6.0 or later.
Is CVE-2021-40086 being exploited?
There is no known exploitation of CVE-2021-40086 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-ejbca-2021-40086, GHSA-gp4q-v358-xp7j.