CVE-2007-4900

Published: Sep 14, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field.

Affected (1)

Products: Rsa: Envision

Rsa

1 product

Envision

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rsa Envision	Version 3.3.6_build_0115

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

http://osvdb.org/37099

Source: cve@mitre.org

http://secunia.com/advisories/26707

Source: cve@mitre.org

http://securityreason.com/securityalert/3137

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/479183/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/25645

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/3198

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/36575

Source: cve@mitre.org

http://osvdb.org/37099