PT-2018-10288 · Rsa · Emc Rsa Authentication Manager
Publicado
2018-09-28
·
Atualizado
2020-03-27
·
CVE-2018-11075
CVSS v3.1
5.8
Média
| Vetor | AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
RSA Authentication Manager versions prior to 8.3 P3
Description
The issue allows a remote, unauthenticated malicious user to potentially exploit a reflected cross-site scripting vulnerability in a Security Console page. This could be achieved by tricking a victim Security Console user into supplying malicious HTML or JavaScript code to the vulnerable web application, which is then executed by the victim's web browser in the context of the vulnerable web application. The malicious user would need knowledge of the target user's anti-CSRF token.
Recommendations
For RSA Authentication Manager versions prior to 8.3 P3, update to version 8.3 P3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Security Console page to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Emc Rsa Authentication Manager