Lucene search

[email protected]CVE-2021-20179

HistoryMar 15, 2021 - 1:15 p.m.

CVE-2021-20179

2021-03-1513:15:14

CWE-863

[email protected]

web.nvd.nist.gov

118

pki-core

vulnerability

certificate renewal

data confidentiality

integrity

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected configurations

Vulners

NVD

Node

pki-core_projectpki-coreRange≤10.5

pki-core_projectpki-coreRange≤10.8

pki-core_projectpki-coreRange≤10.9

pki-core_projectpki-coreRange≤10.10

pki-core_projectpki-coreRange≤10.11

VendorProductVersionCPE
pki\-core_projectpki\-core*cpe:2.3:a:pki\-core_project:pki\-core:*:*:*:*:*:*:*:*
pki\-core_projectpki\-core*cpe:2.3:a:pki\-core_project:pki\-core:*:*:*:*:*:*:*:*
pki\-core_projectpki\-core*cpe:2.3:a:pki\-core_project:pki\-core:*:*:*:*:*:*:*:*
pki\-core_projectpki\-core*cpe:2.3:a:pki\-core_project:pki\-core:*:*:*:*:*:*:*:*
pki\-core_projectpki\-core*cpe:2.3:a:pki\-core_project:pki\-core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pki\-core_project	pki\-core	*	cpe:2.3:a:pki\-core_project:pki\-core::::::::
pki\-core_project	pki\-core	*	cpe:2.3:a:pki\-core_project:pki\-core::::::::
pki\-core_project	pki\-core	*	cpe:2.3:a:pki\-core_project:pki\-core::::::::
pki\-core_project	pki\-core	*	cpe:2.3:a:pki\-core_project:pki\-core::::::::
pki\-core_project	pki\-core	*	cpe:2.3:a:pki\-core_project:pki\-core::::::::

CNA Affected

[
  {
    "product": "pki-core",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "pki-core 10.5, pki-core 10.8, pki-core 10.9, pki-core 10.10, pki-core 10.11"
      }
    ]
  }
]