CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2017-7537
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-592, CWE-798
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dogtagpki:dogtagpki
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation