Twenty Year Anniversary

RSA Authentication Manager Cross Site Scripting

RSA Authentication Manager Cross Site Scripting
Posted Sep 21, 2018
Site emc.com

RSA Authentication Manager versions prior to 8.3 Patch 3 suffer from multiple cross site scripting vulnerabilities.

tags | advisory, vulnerability, xss
advisories | CVE-2018-11073, CVE-2018-11074, CVE-2018-11075
MD5 | 7bf3615a61ab427227e065ee65a79499

RSA Authentication Manager Cross Site Scripting

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

DSA-2018-152: RSA(r) Authentication Manager Multiple Vulnerabilities

Dell EMC Identifier: DSA-2018-152

CVE Identifier: CVE-2018-11073, CVE-2018-11074, CVE-2018-11075

Severity: Medium

Severity Rating: View the details below for the individual CVSS Score for each CVE.

Affected Products:
RSA Authentication Manager versions prior to 8.3 Patch 3
RSA Authentication Manager web-tier server versions prior to 8.3 Patch 3
RSA Authentication Manager Language Pack versions prior to 8.3 Patch 3 (CVE-2018-11074 only)

Summary:
RSA Authentication Manager contains fixes for multiple security vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.

Details:
Multiple components within RSA Authentication Manager have been updated to address various vulnerabilities.

The components are updated for the following vulnerabilities:

Stored Cross-Site Scripting (CVE 2018-11073)
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)

DOM-Based Cross-Site Scripting (CVE-2018-11074)
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application
CVSSv3 Base Score 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)


Reflected Cross-Site Scripting (CVE-2018-11075)
RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application.
CVSSv3 Base SCore: 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L)

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database's search utility at http://web.nvd.nist.gov/view/vuln/search.

Recommendation:
The following RSA Authentication Manager releases contain resolutions to these vulnerabilities:
RSA Authentication Manager 8.3 Patch 3 and later
RSA Authentication Manager 8.3 Patch 3 and later web-tier server
RSA Authentication Manager Language Packs version 8.3 P3 and later (CVE-2018-11074)

RSA recommends all customers upgrade at the earliest opportunity.


Severity Rating

For an explanation of Severity Ratings, refer to the Security Advisories Severity Rating (https://community.rsa.com/docs/DOC-47147) knowledge base article. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.



Legal Information

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Technical Support (https://community.rsa.com/docs/DOC-1294). RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.



Dell EMC Product Security Incident Response Team

secure@dell.com

http://www.emc.com/products/security/product-security-response-center.htm
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEP5nobPoCj3pTvhAZgSlofD2Yi6cFAluhQ3MACgkQgSlofD2Y
i6cz3w/+MUEdG8wvekXlzGfgNJjA9QBZ8hPoBFuGQo3ZS9D0GzjQEY3YQVWuhTmY
Za8IuWxu4GQp7juN7UcIEu0t1h/OmJ5sCRGSsCveIvmu4/e43VthrMqESmg3m8DC
hdzLDNldVZcY+ZWeY0z9sFESTj4Pt3MJRjqDnP/Jq+b6trjftd7jU71gwRRriSBn
TM7eUjoq7RniXfoHD54UjFH1kzmO/ZFr9lRXMfBCiqUaA6x23dvMEuP5pdU334mZ
qzUm2UuLs34YJ6g0fFGB+7y92H9KMz1CRYnCd0G8ijMTNVgztbahaTaVkVKd5Bx2
yk2LN/HBSLt5oUh7eGZtnDSsgsmWsMd3hB3ZlbdCGibx4VFJ0XUnNEc4EDa1n5Cq
FRI1qT2DPEUPOwwm2ZJ0m5spRFd+mLlaUOs6wDOb0o0NLt5jQfY1g9y+AV1D3MO9
8bhs0NsyNnzO6NtA7+3Y3vsqcynBycuW0I8dwgOa+meGs3KogB/Zs8jU6grgBtoM
uINjnoFB8MI0yGPH7AAeQrfCOEjvU70wryvw36FWeJ/6KS4OAVt2WYqCN4UVjz7E
WHqVM9rcPEW4n5JLs2XVvlGecWkk609pTD0XGTfIBfmGbVlOKNNiCMIBtbXJrgd2
cdDnqoBGOHMleKsfQlgurYUNuznZvXkmWm1VZoPbZhF+TRtF6/g=
=1eRg
-----END PGP SIGNATURE-----




Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close