CVE-2020-11631

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-08 · updated 2026-06-17

Description

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)

Affected products

PrimeKey Solutions AB EJBCA: before 6.15.2.6; from 7.0.0 before 7.3.1.2 — fixed in 6.15.2.6, 7.3.1.2

How to fix

Upgrade to a fixed version: PrimeKey Solutions AB EJBCA 6.15.2.6, 7.3.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11631 or the next vulnerability affects your stack