Primekey Ejbca
16 CVEs affecting Primekey Ejbca. Latest disclosed: 2025-03-31. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34831 | Critical | 9.8 | 2022-09-14 | An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the cor… |
CVE-2020-11630 | Critical | 9.8 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes… |
CVE-2020-11627 | High | 8.8 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery (CSRF) issue has been found in the CA UI. |
CVE-2020-25276 | High | 7.3 | 2020-09-11 | An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is per… |
CVE-2020-11629 | High | 7.2 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload exte… |
CVE-2020-11631 | Medium | 6.5 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allow… |
CVE-2025-3027 | Medium | 6.1 | 2025-03-31 | The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server… |
CVE-2025-3026 | Medium | 6.1 | 2025-03-31 | The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is… |
CVE-2020-11626 | Medium | 6.1 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and t… |
CVE-2021-40088 | Medium | 5.4 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The… |
CVE-2020-11628 | Medium | 5.3 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols (CMP, ACME, REST… |
CVE-2022-40711 | Medium | 4.8 | 2023-01-01 | PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-… |
CVE-2020-28942 | Medium | 4.3 | 2020-11-19 | An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain securit… |
CVE-2021-40087 | Low | 2.7 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secr… |
CVE-2021-40089 | Low | 2.3 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing… |
CVE-2021-40086 | Low | 2.2 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment sec… |