PT-2020-18418 · Rsa · Emc Rsa Authentication Manager

Published 2020-04-15 · Updated 2022-09-30 · CVE-2020-5346

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSA Authentication Manager versions prior to 8.4 P11

Description The issue concerns a stored cross-site scripting vulnerability in the Security Console of RSA Authentication Manager. A malicious administrator with advanced privileges could exploit this to store arbitrary HTML or JavaScript code through the Security Console web interface. When other administrators open the affected page, the injected scripts could potentially be executed in their browser.

Recommendations For RSA Authentication Manager versions prior to 8.4 P11, update to version 8.4 P11 or later to resolve the issue. As a temporary workaround, consider restricting access to the Security Console web interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-5346

Affected Products

Emc Rsa Authentication Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-5346 · Security Note
• https://community.rsa.com/docs/DOC-111347 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5346 · Vendor Advisory
• https://t.me/cvenotify/2813 · Telegram Post