PT-2015-7391 · Emc · Emc Rsa Securid Web Agent

Published 2015-12-23 · Updated 2016-12-07 · CVE-2015-6851

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC RSA SecurID Web Agent versions prior to 8.0

Description The issue allows physically proximate attackers to bypass the privacy-screen protection mechanism. This can be achieved by leveraging an unattended workstation and utilizing the DOM Inspector.

Recommendations For versions prior to 8.0, update to version 8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to unattended workstations to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-6851

Affected Products

Emc Rsa Securid Web Agent

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-6851 · Security Note
• http://securityfocus.com/bid/79646 · Note
• http://packetstormsecurity.com/files/135013/RSA-SecurID-Web-Agent-Authentication-Bypass.html · Note
• http://securitytracker.com/id/1034510 · Note
• http://seclists.org/bugtraq/2015/Dec/115 · Note