CVE-2022-2393
Last modified
CVE-2022-2393 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Metrics
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pki-Core Project | Pki-Core | <= 10.12.4 |
| Redhat | Certificate System | 9.0 |
| Redhat | Certificate System | 10.0 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux | 9.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2101046Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2101046Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2393?
How severe is CVE-2022-2393?
How do I fix CVE-2022-2393?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23924Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23925Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23926Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23927Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23928Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23929Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23930Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23931Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23932Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23933Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23934Potential vulnerabilities have been identified in the system…8.2
- CVE-2022-23935lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a …7.8
Are you affected by CVE-2022-2393?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST