CVE-2023-34196

2023-08-0300:00:00

mitre

www.cve.org

keyfactor ejbca

ra web

certificate distribution

vulnerability

authentication issue

ca certificate disclosure

risk

partial denial of service

oauth

unauthenticated users

less privileged

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.3%

JSON

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.

References

keyfactor.com

support.keyfactor.com/hc/en-us/articles/16671824556827-EJBCA-Security-Advisory-Partial-denial-of-service-attack-on-certificate-distribution-servlet-ejbca-ra-cert