CVE-2018-1080

High

Description

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

SeverityHigh

CVSS7.5

Exploit probability—

ProductDogtagpki

PublishedJul 3, 2018

First seenJul 3, 2018

Weakness typeCWE-284Improper access control

How to fix

Vendor advisories

access.redhat.com/errata/RHSA-2018:1979

Affected products

Product	Affected versions	Fixed in
dogtagpki dogtagpki	v ≤ 10.6.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.