PT-2008-3037 · Rsa · Webid Rsa Authentication Agent

Quentin Berdugo · Published 2008-03-24 · Updated 2018-10-11 · CVE-2008-1470

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebID RSA Authentication Agent version 5.3 and possibly earlier

Description The issue is related to an incomplete blacklist vulnerability in the IISWebAgentIF.dll component. This allows remote attackers to conduct cross-site scripting (XSS) attacks via the postdata parameter, due to an incomplete fix for a previously known issue.

Recommendations For WebID RSA Authentication Agent version 5.3 and possibly earlier, consider restricting access to the postdata parameter in the affected API endpoint until a comprehensive fix is available. As a temporary workaround, avoid using the postdata parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-1470

Affected Products

Webid Rsa Authentication Agent

References · 6

• 🔥 http://securityfocus.com/bid/28277 · Exploit
• 🔥 https://exploit-db.com/exploits/31411 · Exploit
• 🔥 https://exploit-db.com/exploits/11405 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1470 · Security Note
• http://securityfocus.com/archive/1/489691/100/0/threaded · Note
• http://securityreason.com/securityalert/3768 · Note