PT-2018-11227 · Rsa · Emc Rsa Web Threat Detection

Publicado 2018-06-05 · Atualizado 2019-07-15 · CVE-2018-1252

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Web Threat Detection versions prior to 6.4

Description The issue allows an authenticated malicious user with low privileges to potentially execute SQL commands on the back-end database by supplying specially crafted input data to the affected Administration and Forensics applications. This could lead to unauthorized access to the tool's monitoring and user information.

Recommendations For RSA Web Threat Detection versions prior to 6.4, update to version 6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Administration and Forensics applications to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-1252

Produtos afetados

Emc Rsa Web Threat Detection

Referências · 5

• http://securityfocus.com/bid/104396 · Nota
• https://osv.dev/vulnerability/CVE-2018-1252 · Aviso do Fabricante
• http://securitytracker.com/id/1041026 · Nota
• http://seclists.org/fulldisclosure/2018/Jun/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1252 · Nota de Segurança