PT-2007-6014 · Rsa · Rsa Envision

Stelios Tigkas · Publicado 2007-09-14 · Atualizado 2018-10-15 · CVE-2007-4900

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: RSA EnVision version 3.3.6 Build 0115

Description: A cross-site scripting (XSS) issue exists in the logon page, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could potentially lead to unauthorized actions on the affected system.

Recommendations: For RSA EnVision version 3.3.6 Build 0115, consider restricting access to the logon page until a fix is available, and avoid using the username field in a manner that could facilitate XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-4900

Produtos afetados

Rsa Envision

Referências · 8

• http://securityreason.com/securityalert/3137 · Nota
• http://osvdb.org/37099 · Nota
• http://vupen.com/english/advisories/2007/3198 · Nota
• http://securityfocus.com/archive/1/479183/100/0/threaded · Nota
• http://secunia.com/advisories/26707 · Nota
• http://securityfocus.com/bid/25645 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4900 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36575 · Nota