Dogtag PKI 10.8.0 B3

CPE Details

Dogtag PKI 10.8.0 B3
dogtagpki
dogtagpki
10.8.0
2020-03-23
14h10 +00:00
2021-05-06
12h37 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:dogtagpki:dogtagpki:10.8.0:b3:*:*:*:*:*:*

Informations

Vendor

dogtagpki

Product

dogtagpki

Version

10.8.0

Update

b3

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-15720 2020-07-14 11h46 +00:00 In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
6.8
Medium
CVE-2019-10180 2020-03-31 14h31 +00:00 A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.
4.8
Medium
CVE-2020-1696 2020-03-20 12h58 +00:00 A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.
5.4
Medium
CVE-2019-10179 2020-03-20 12h57 +00:00 A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
6.1
Medium
CVE-2019-10221 2020-03-20 12h55 +00:00 A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
6.1
Medium
CVE-2019-10178 2020-03-18 13h57 +00:00 It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.
6.1
Medium