Management API Key Bypass

An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976...

System: missing public key challenge proof verification in the TPS component

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...