DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
CVE-2018-11074

6.1MEDIUM

Key Information:

Vendor
Rsa
Status
Authentication Manager
Vendor
CVE Published:
28 September 2018

Summary

RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application.

Affected Version(s)

Authentication Manager < 8.3 P3

References

https://seclists.org/fulldisclosure/2018/Sep/39
mailing-listx_refsource_FULLDISC
http://www.securitytracker.com/id/1041697
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/105410
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

RSA would like to thank Mantas Juskauskas from SEC Consult Vulnerability for reporting CVE-2018-11074.
.