PT-2017-18058 · Emc · Emc Rsa Authentication Manager

Published 2017-07-17 · Updated 2017-08-10 · CVE-2017-8000

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication Manager versions 8.2 SP1 and earlier

Description A malicious RSA Security Console Administrator could craft a token profile with a name that includes a crafted script containing an XSS payload. This script could be executed when another administrator views or edits the assigned token profile in their browser session.

Recommendations For versions 8.2 SP1 and earlier, consider restricting access to the RSA Security Console Administrator role to minimize the risk of exploitation. As a temporary workaround, avoid viewing or editing token profiles that may contain malicious scripts until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8000

Affected Products

Emc Rsa Authentication Manager

References · 5

• https://osv.dev/vulnerability/CVE-2017-8000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8000 · Security Note
• http://securitytracker.com/id/1038878 · Note
• http://seclists.org/fulldisclosure/2017/Jul/25 · Note
• http://securityfocus.com/bid/99572 · Note