CVE-2007-4594
Entrust Entelligence Security Provider (ESP) 8 does not properly validate certificates in certain circumstances involving (1) a chain that…
Published 19 y ago · modified 4 mo ago · JSON
Summary
Entrust Entelligence Security Provider (ESP) 8 does not properly validate certificates in certain circumstances involving (1) a chain that omits the root Certification Authority (CA) certificate, or an application that specifies disregarding (2) unknown revocation statuses during path validation or (3) certain errors in the certification path, which might allow context-dependent attackers to spoof certificate authentication. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploit prediction (EPSS)
0.63% probability of exploitation in the next 30 days, higher than 50% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
- CWE-255 Credentials Management Errors
References
- secunia.com /advisories/26630 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securityfocus.com /bid/25471 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/36331 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2007-4594
- NVD: CVE-2007-4594
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.