Unscored severity · published Nov 17, 2010
CVE-2010-3869
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single…
–
CVSS
0.8%
EPSS
No
On KEV
Description
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
7.3; 8 · source: NVD
DC
Dogtag Certificate System · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3869
Vendor Advisory
http://secunia.com/advisories/42181
securitytracker.com
http://securitytracker.com/id?1024697
www.osvdb.org
http://www.osvdb.org/69148
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=648883
Patch
https://fedorahosted.org/pki/changeset/1246
Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2010-0837.html
More from Certificate System
8.1
CVE-2021-20179
A flaw was found in pki-core
6.5
CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1
5.7
CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled
5.4
CVE-2020-1696
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting…
4.8
CVE-2019-10180
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly…