CyberRota Analysis
AI-GeneratedA vulnerability exists in Dogtag PKI's ACME responder due to improper URL pattern matching in the web.xml security constraints, allowing unauthenticated attackers to bypass authentication for admin-only endpoints. By appending a trailing slash to the URL, attackers can toggle the ACME service state, potentially leading to unauthorized service disruptions or persistent denial of service. Organizations using Dogtag PKI should prioritize addressing this issue to safeguard their systems against unauthorized access and service interruptions.
Original NVD Description
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.