CVE-2021-40089 Security feature bypass in n/a
Attackers can execute local scripts via existing publishers even when external script access is disabled, bypassing security controls in EJBCA.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40089?
CVE-2021-40089 is a low-severity vulnerability in n/a, published on 25 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
Which versions are affected by CVE-2021-40089?
1 open source package ship an affected version, including ejbca. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ejbca Bitnami | All versions | 7.6.0 |
Products include Primekey Ejbca.
How do I fix CVE-2021-40089?
Upgrade ejbca to 7.6.0 or later.
Is CVE-2021-40089 being exploited?
There is no known exploitation of CVE-2021-40089 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-ejbca-2021-40089, GHSA-jfp8-v3xr-q53j.