CVE-2021-40089
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher,...
CVE-2021-40089 is a low vulnerability (CVSS 2.3) in Primekey Ejbca, published August 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in ejbca 7.6.0.
- Severity
- 2.3 LowCVSS 3.1, NVD
- Exploit chance
- 0.22%EPSS, 13th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.6.0ejbca
Description
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ejbcaBitnami | before 7.6.0 | 7.6.0 |
What each source reports
NVD Score used
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Record
CVE-2021-40089- CVSS 3.1
- 2.3 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Record
CVE-2021-40089- Updated
- 2026-11-02
EUVDEUVD-2021-27278No score
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Record
EUVD-2021-27278- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfp8-v3xr-q53jNo score
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher,...
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Record
GHSA-jfp8-v3xr-q53j- Updated
- 2026-11-02
OSVBIT-ejbca-2021-40089No score
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Record
BIT-ejbca-2021-40089- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.