PT-2009-2355 · Rsa · Rsa Envision

Nicolas Viot · Publicado 2009-08-03 · Atualizado 2017-08-17 · CVE-2008-6886

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: RSA EnVision versions 3.5.0 through 3.5.2 RSA EnVision version 3.7.0

Description: The issue allows remote attackers to obtain the administrator password hash, which can then be used to conduct brute force guessing attacks. This is due to improper restriction of access to user profile functionality.

Recommendations: For RSA EnVision versions 3.5.0 through 3.5.2, restrict access to user profile functionality to prevent unauthorized access. For RSA EnVision version 3.7.0, restrict access to user profile functionality to prevent unauthorized access. As a temporary workaround, consider restricting access to the administrator account until a fix is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-6886

Produtos afetados

Rsa Envision

Referências · 8

• http://osvdb.org/50273 · Nota
• http://securityfocus.com/bid/32473 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6886 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46884 · Nota
• http://vupen.com/english/advisories/2008/3288 · Aviso do Fabricante
• http://secunia.com/advisories/32883 · Aviso do Fabricante
• http://secfault.org/?p=78 · Correção
• http://marc.info/?l=bugtraq&m=122765140110581&w=2 · Correção