CVE-2021-40088

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

• CWE-862

• https://support.primekey.com/news/posts/51Vendor Advisory
• https://support.primekey.com/news/posts/51Vendor Advisory

Published

Aug 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4008A flaw was found in xorg-x11-server in versions before 21.1.…7.8
• CVE-2021-40083Knot Resolver before 5.3.2 is prone to an assertion failure,…7.5
• CVE-2021-40084opensysusers through 0.6 does not safely use eval on files i…9.8
• CVE-2021-40085An issue was discovered in OpenStack Neutron before 16.4.1, …6.5
• CVE-2021-40086An issue was discovered in PrimeKey EJBCA before 7.6.0. As p…2.2
• CVE-2021-40087An issue was discovered in PrimeKey EJBCA before 7.6.0. When…2.7
• CVE-2021-40089An issue was discovered in PrimeKey EJBCA before 7.6.0. The …2.3
• CVE-2021-4009A flaw was found in xorg-x11-server in versions before 21.1.…7.8
• CVE-2021-40091An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.665…9.8
• CVE-2021-40092A cross-site scripting (XSS) vulnerability in Image Tile in …5.4
• CVE-2021-40093A cross-site scripting (XSS) vulnerability in integration co…5.4
• CVE-2021-40094A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2…5.4