Boks Manager
Monthly
Remote unauthenticated attackers can crash the boks_portmux daemon in Fortra BoKS Manager by sending a single malformed TLS ClientHello to its custom TLS listener, and repeated requests can sustain a denial-of-service condition because the daemon is normally restarted automatically. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this as a high-availability-impact issue; no public exploit code, KEV listing, or active exploitation has been identified at time of analysis.
Command injection in Fortra BoKS Manager's crlserver component allows an authenticated principal holding the delegated CRL-URL-add capability to run arbitrary shell commands as root on the BoKS Master, yielding full compromise of the host that anchors the BoKS trust domain. Three delivery paths exist: the BCC administration console and the WSI REST/SOAP API are network-reachable and require no local sudo or suexec rule, while the cacrl command-line path needs a sudo/suexec rule for non-root use. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) confirms a network-reachable, scope-changing, high-integrity/high-availability impact; exploitation is gated by the attacker already possessing CRL-URL-add authorization plus an active crlserver on a BoKS Master, and no public exploit code was identified at time of analysis.
Fortra BoKS Manager's bccgethostcert utility writes predictably named temporary files under the BOKS_tmp directory without first setting a restrictive umask, so a local, authenticated low-privileged user on a BoKS Master host can capture CA secret or host private-key material - either by reading the files during the window in which a privileged operator runs the utility, or by recovering CA secret material left behind after a successful certificate creation. The issue is scored 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, CWE-377), and its confidentiality and integrity impact is high precisely because the leaked material is CA-level keying material rather than ordinary application data. Exploitation is access-gated rather than remote: it requires a Master-local account, read access to files under BOKS_tmp, and the utility actually being invoked by a privileged user. No public exploit code has been identified at time of analysis, and KEV/EPSS signals were not provided in the source data.
Remote unauthenticated attackers can crash the boks_portmux daemon in Fortra BoKS Manager by sending a single malformed TLS ClientHello to its custom TLS listener, and repeated requests can sustain a denial-of-service condition because the daemon is normally restarted automatically. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this as a high-availability-impact issue; no public exploit code, KEV listing, or active exploitation has been identified at time of analysis.
Command injection in Fortra BoKS Manager's crlserver component allows an authenticated principal holding the delegated CRL-URL-add capability to run arbitrary shell commands as root on the BoKS Master, yielding full compromise of the host that anchors the BoKS trust domain. Three delivery paths exist: the BCC administration console and the WSI REST/SOAP API are network-reachable and require no local sudo or suexec rule, while the cacrl command-line path needs a sudo/suexec rule for non-root use. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) confirms a network-reachable, scope-changing, high-integrity/high-availability impact; exploitation is gated by the attacker already possessing CRL-URL-add authorization plus an active crlserver on a BoKS Master, and no public exploit code was identified at time of analysis.
Fortra BoKS Manager's bccgethostcert utility writes predictably named temporary files under the BOKS_tmp directory without first setting a restrictive umask, so a local, authenticated low-privileged user on a BoKS Master host can capture CA secret or host private-key material - either by reading the files during the window in which a privileged operator runs the utility, or by recovering CA secret material left behind after a successful certificate creation. The issue is scored 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, CWE-377), and its confidentiality and integrity impact is high precisely because the leaked material is CA-level keying material rather than ordinary application data. Exploitation is access-gated rather than remote: it requires a Master-local account, read access to files under BOKS_tmp, and the utility actually being invoked by a privileged user. No public exploit code has been identified at time of analysis, and KEV/EPSS signals were not provided in the source data.