PT-2007-6014 · Rsa · Rsa Envision

Stelios Tigkas · Published 2007-09-14 · Updated 2018-10-15 · CVE-2007-4900

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: RSA EnVision version 3.3.6 Build 0115

Description: A cross-site scripting (XSS) issue exists in the logon page, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could potentially lead to unauthorized actions on the affected system.

Recommendations: For RSA EnVision version 3.3.6 Build 0115, consider restricting access to the logon page until a fix is available, and avoid using the username field in a manner that could facilitate XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-4900

Affected Products

Rsa Envision

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4900 · Security Note
• http://securityreason.com/securityalert/3137 · Note
• http://osvdb.org/37099 · Note
• http://vupen.com/english/advisories/2007/3198 · Note
• http://securityfocus.com/archive/1/479183/100/0/threaded · Note
• http://secunia.com/advisories/26707 · Note
• http://securityfocus.com/bid/25645 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36575 · Note