CVE-2021-40087 Information disclosure in n/a
Cleartext enrollment secrets are logged in audit logs when protocol aliases change, exposing sensitive data to administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40087?
CVE-2021-40087 is a low-severity vulnerability in n/a, published on 25 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.
Weakness: CWE-312
Which versions are affected by CVE-2021-40087?
1 open source package ship an affected version, including ejbca. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ejbca Bitnami | All versions | 7.6.0 |
Products include Primekey Ejbca.
How do I fix CVE-2021-40087?
Upgrade ejbca to 7.6.0 or later.
Is CVE-2021-40087 being exploited?
There is no known exploitation of CVE-2021-40087 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-ejbca-2021-40087, GHSA-v766-f6mm-cqpp.