PT-2020-18414 · Rsa · Emc Rsa Authentication Manager

Published 2020-03-25 · Updated 2022-09-30 · CVE-2020-5340

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager versions prior to 8.4 P10

Description The issue concerns a stored cross-site scripting vulnerability in the Security Console of RSA Authentication Manager. A malicious administrator with advanced privileges could exploit this to store arbitrary HTML or JavaScript code through the Security Console web interface. When other administrators attempt to change the default security domain mapping, the injected scripts could potentially be executed in their browser.

Recommendations For versions prior to 8.4 P10, update to version 8.4 P10 or later to resolve the issue. As a temporary workaround, consider restricting access to the Security Console web interface to minimize the risk of exploitation. Additionally, limit the privileges of administrators to reduce the potential impact of this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-5340

Affected Products

Emc Rsa Authentication Manager

References · 4

• https://osv.dev/vulnerability/CVE-2020-5340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5340 · Security Note
• https://community.rsa.com/docs/DOC-111092 · Vendor Advisory
• https://t.me/cvenotify/2190 · Telegram Post