PT-2017-18058 · Emc · Emc Rsa Authentication Manager

Publicado 2017-07-17 · Atualizado 2017-08-10 · CVE-2017-8000

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication Manager versions 8.2 SP1 and earlier

Description A malicious RSA Security Console Administrator could craft a token profile with a name that includes a crafted script containing an XSS payload. This script could be executed when another administrator views or edits the assigned token profile in their browser session.

Recommendations For versions 8.2 SP1 and earlier, consider restricting access to the RSA Security Console Administrator role to minimize the risk of exploitation. As a temporary workaround, avoid viewing or editing token profiles that may contain malicious scripts until a fix is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8000

Produtos afetados

Emc Rsa Authentication Manager

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-8000 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8000 · Nota de Segurança
• http://securitytracker.com/id/1038878 · Nota
• http://seclists.org/fulldisclosure/2017/Jul/25 · Nota
• http://securityfocus.com/bid/99572 · Nota