{"api_version":"1","generated_at":"2026-07-24T00:31:32+00:00","cve":"CVE-2012-3367","urls":{"html":"https://cve.report/CVE-2012-3367","api":"https://cve.report/api/cve/CVE-2012-3367.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-3367","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-3367"},"summary":{"title":"CVE-2012-3367","description":"Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate.","state":"PUBLISHED","assigner":"redhat","published_at":"2012-08-13 20:55:08","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-310","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=836268","name":"https://bugzilla.redhat.com/show_bug.cgi?id=836268","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"836268 – (CVE-2012-3367) CVE-2012-3367 Certificate System: CA certificate can be revoked","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/77102","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/77102","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/84098","name":"http://osvdb.org/84098","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://fedorahosted.org/pki/changeset/2430","name":"https://fedorahosted.org/pki/changeset/2430","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"Overview - dogtagpki - Pagure.io","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/50013","name":"http://secunia.com/advisories/50013","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA50013 - Red Hat Certificate System Cross-Site Scripting and Security Bypass Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1103.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1103.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/54608","name":"http://www.securityfocus.com/bid/54608","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Certificate System Multiple Cross Site Scripting and Security Bypass Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id?1027284","name":"http://www.securitytracker.com/id?1027284","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Certificate System Bugs Let Remote Users Conduct Cross-Site Scripting and Denial of Service Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3367","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3367","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"7.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"8.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"certificate_system","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"dogtag_certificate_system","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:05:12.335Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=836268"},{"name":"1027284","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1027284"},{"name":"84098","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/84098"},{"name":"50013","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/50013"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://fedorahosted.org/pki/changeset/2430"},{"name":"rhcs-certificate-manager-sec-bypass(77102)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/77102"},{"name":"54608","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/54608"},{"name":"RHSA-2012:1103","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1103.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-07-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=836268"},{"name":"1027284","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1027284"},{"name":"84098","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/84098"},{"name":"50013","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/50013"},{"tags":["x_refsource_CONFIRM"],"url":"https://fedorahosted.org/pki/changeset/2430"},{"name":"rhcs-certificate-manager-sec-bypass(77102)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/77102"},{"name":"54608","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/54608"},{"name":"RHSA-2012:1103","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1103.html"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-3367","datePublished":"2012-08-13T20:00:00.000Z","dateReserved":"2012-06-14T00:00:00.000Z","dateUpdated":"2024-08-06T20:05:12.335Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-08-13 20:55:08","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-310","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:*:*:*:*:*:*:*:*","versionEndIncluding":"8.1","matchCriteriaId":"FE009B1B-E0AB-4BA4-9A18-5F2A45FDCB7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:7.1:*:*:*:*:*:*:*","matchCriteriaId":"A94B7103-11B7-4B1E-AE02-86210F9CCCAA"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:7.2:*:*:*:*:*:*:*","matchCriteriaId":"27FE079E-FB15-443C-BE2E-1D4C940BB8C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*","matchCriteriaId":"E2654E6A-190C-4D5C-ABC0-89011DD8E293"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*","matchCriteriaId":"C2EF75FF-FCDB-433C-A7B9-4DBAABAC6643"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:certificate_system:8.0:*:*:*:*:*:*:*","matchCriteriaId":"969F1FDC-EB66-4758-B619-C48CA1E5B1AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:dogtag_certificate_system:*:*:*:*:*:*:*:*","matchCriteriaId":"06D606EF-447B-42C5-ADBE-14515257262B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"3367","Ordinal":"1","Title":"CVE-2012-3367","CVE":"CVE-2012-3367","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"3367","Ordinal":"1","NoteData":"Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate.","Type":"Description","Title":"CVE-2012-3367"},{"CveYear":"2012","CveId":"3367","Ordinal":"2","NoteData":"2012-08-13","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"3367","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}