CVE-2017-7537

2018-07-2613:00:00

CWE-592

redhat

www.cve.org

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

52.3%

JSON

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

CNA Affected

[
  {
    "product": "pki-core",
    "vendor": "Dogtag PKI",
    "versions": [
      {
        "status": "affected",
        "version": "10.6.4"
      }
    ]
  }
]