Unscored severity · published Nov 17, 2010
CVE-2010-3868
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
7.3; 8 · source: NVD
DC
Dogtag Certificate System · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3868
Vendor Advisory
http://secunia.com/advisories/42181
securitytracker.com
http://securitytracker.com/id?1024697
www.osvdb.org
http://www.osvdb.org/69149
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=648882
Patch
https://fedorahosted.org/pki/changeset/1261
rhn.redhat.com
https://rhn.redhat.com/errata/RHSA-2010-0837.html
More from Certificate System
8.1
CVE-2021-20179
A flaw was found in pki-core
6.5
CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1
5.7
CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled
5.4
CVE-2020-1696
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting…
4.8
CVE-2019-10180
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly…