An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ejbca | Primekey | * | 6.15.2.6 (excluding) |
| Ejbca | Primekey | 7.0.0 (including) | 7.3.1.2 (excluding) |