Archive of EJBCA security issues

We maintain the following historical list of EJBCA security issues which have been fixed and submitted as CVEs (Common Vulnerabilities and Exposures).

For issues affecting supported versions of EJBCA, the list includes the CVE identifier, a link to the full security advisory, and relevant release notes. Additionally, CVEs affecting unsupported versions are also listed with links to release notes.

To learn more about our security posture, refer to Keyfactor Trust Center.

2024

CVE-2024-36066

EJBCA standalone CMP CLI client - View EJBCA Security Advisory

Resolved in product version: EJBCA 8.3.1

2023

CVE-2023-34196

Partial denial of service attack on certificate distribution servlet /ejbca/ra/cert - View EJBCA Security Advisory

Resolved in product version: EJBCA 8.0

Security issues in EJBCA versions no longer supported

2022

CVE-2022-42954

XSS Vulnerability in EJBCA RA Web

Resolved in EJBCA version: EJBCA 7.10.0.1

CVE-2022-39834

XSS Vulnerability in EJBCA CA UI

Resolved in EJBCA version: EJBCA 7.10.0.1