CVE-2020-11630
Published Apr 8, 2020
Last updated 5 years ago
Overview
- Description
- An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes (connected via the Peers protocol) allows insecure objects to be deserialized.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-502
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "736F366E-25F7-4366-A522-35127922E74E",
"versionEndExcluding": "6.15.2.6"
},
{
"criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "948B0043-AAFB-48B4-A120-2683A3831AB3",
"versionEndExcluding": "7.3.1.2",
"versionStartIncluding": "7.0.0"
}
],
"operator": "OR"
}
]
}
]