nvd-json-data-feeds/CVE-2020/CVE-2020-116xx/CVE-2020-11630.json

{
  "id": "CVE-2020-11630",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-04-08T00:15:11.440",
  "lastModified": "2020-04-08T19:02:30.510",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes (connected via the Peers protocol) allows insecure objects to be deserialized."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3  un problema en EJBCA versiones anteriores a 6.15.2.6 y versiones 7.x anteriores a 7.3.1.2. En varias secciones de c\u00f3digo, la comprobaci\u00f3n de objetos serializados enviados entre nodos (conectados por medio del protocolo Peers) permite a objetos no seguros ser deserializados."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*",
              "versionEndExcluding": "6.15.2.6",
              "matchCriteriaId": "736F366E-25F7-4366-A522-35127922E74E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndExcluding": "7.3.1.2",
              "matchCriteriaId": "948B0043-AAFB-48B4-A120-2683A3831AB3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.primekey.com/news/posts/ejbca-security-advisory-deserialization-bug",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}