CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10221 – pki-core: Reflected XSS in getcookies?url= endpoint in CA
https://notcve.org/view.php?id=CVE-2019-10221
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser. Se detectó una vulnerabilidad de tipo Cross Site Scripting Reflejado en todas las versiones de pki-core 10.x.x, en el módulo pki-ca del servidor pki-core. Este fallo es debido a la falta de saneamiento de los parámetros GET URL. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10221 https://access.redhat.com/security/cve/CVE-2019-10221 https://bugzilla.redhat.com/show_bug.cgi?id=1732565 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10146 – pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page
https://notcve.org/view.php?id=CVE-2019-10146
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser. Se detectó un fallo de tipo Cross Site Scripting Reflejado en todos los módulos pki-core versiones 10.x.x del servidor pki-core debido a que el CA Agent Service no sanea apropiadamente la página de petición de certificado. Un atacante podría inyectar un valor especialmente diseñado que será ejecutado en el navegador de la víctima. A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10146 https://access.redhat.com/security/cve/CVE-2019-10146 https://bugzilla.redhat.com/show_bug.cgi?id=1710171 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1080 – pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access
https://notcve.org/view.php?id=CVE-2018-1080
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences. Dogtag PKI, hasta la versión 10.6.1, tiene una vulnerabilidad en AAclAuthz.java que, bajo ciertas configuraciones, provoca que la aplicación de listas de control de acceso permita que las reglas allow y deny se reviertan. Si un servidor está configurado para procesar las reglas allow antes que las deny (authz.evaluateOrder=allow,deny), las reglas allow denegarán el acceso y las reglas deny lo permitirán. • https://access.redhat.com/errata/RHSA-2018:1979 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080 https://pagure.io/freeipa/issue/7453 https://review.gerrithub.io/c/dogtagpki/pki/+/404435 https://access.redhat.com/security/cve/CVE-2018-1080 https://bugzilla.redhat.com/show_bug.cgi?id=1556657 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2017-7537 – pki-core: mock CMC authentication plugin with hardcoded secret enabled by default
https://notcve.org/view.php?id=CVE-2017-7537
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates. Se ha detectado que un plugin de autenticación CMC simulado con un secreto embebido se ha habilitado por accidente y por defecto en el paquete pki-core en versiones anteriores a la 10.6.4. Un atacante podría utilizar este fallo para omitir el proceso de autenticación regular y engañar al servidor CA para que envíe certificados. It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. • https://access.redhat.com/errata/RHSA-2017:2335 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7537 https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9 https://access.redhat.com/security/cve/CVE-2017-7537 https://bugzilla.redhat.com/show_bug.cgi?id=1470817 • CWE-287: Improper Authentication CWE-592: DEPRECATED: Authentication Bypass Issues CWE-798: Use of Hard-coded Credentials •