PT-2018-10288 · Rsa · Emc Rsa Authentication Manager

Published 2018-09-28 · Updated 2020-03-27 · CVE-2018-11075

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager versions prior to 8.3 P3

Description The issue allows a remote, unauthenticated malicious user to potentially exploit a reflected cross-site scripting vulnerability in a Security Console page. This could be achieved by tricking a victim Security Console user into supplying malicious HTML or JavaScript code to the vulnerable web application, which is then executed by the victim's web browser in the context of the vulnerable web application. The malicious user would need knowledge of the target user's anti-CSRF token.

Recommendations For RSA Authentication Manager versions prior to 8.3 P3, update to version 8.3 P3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Security Console page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11075

Affected Products

Emc Rsa Authentication Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-11075 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11075 · Vendor Advisory
• http://securitytracker.com/id/1041697 · Note
• http://securityfocus.com/bid/105410 · Note
• https://seclists.org/fulldisclosure/2018/Sep/39 · Note