Unscored severity · published Jan 30, 2009
CVE-2008-5082
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully…
–
CVSS
0.8%
EPSS
No
On KEV
Description
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
7.1; 7.2; 7.3 · source: NVD
DC
Dogtag Certificate System · Redhat
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5082
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5082
Vendor Advisory
http://secunia.com/advisories/33693
www.securityfocus.com
http://www.securityfocus.com/bid/33508
www.vupen.com
http://www.vupen.com/english/advisories/2009/0145
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=475998
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/48331
Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2009-0007.html
More from Certificate System
8.1
CVE-2021-20179
A flaw was found in pki-core
6.5
CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1
5.7
CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled
5.4
CVE-2020-1696
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting…
4.8
CVE-2019-10180
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly…