CVE-2019-18574

Published: Dec 3, 2019Modified: Nov 21, 2024

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface which could then be included in a report. When other Security Console administrators open the affected report, the injected scripts could potentially be executed in their browser.

Affected (9)

Products: Emc: Rsa Authentication Manager · Rsa: Authentication Manager

Emc

1 product

Rsa Authentication Manager

Rsa

1 product

Authentication Manager

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Emc Rsa Authentication Manager	Version 8.4
Emc Rsa Authentication Manager	Version 8.4 p1
Emc Rsa Authentication Manager	Version 8.4 p2
Emc Rsa Authentication Manager	Version 8.4 p3
Emc Rsa Authentication Manager	Version 8.4 p4
Emc Rsa Authentication Manager	Version 8.4 p5
Emc Rsa Authentication Manager	Version 8.4 p6
Emc Rsa Authentication Manager	Version 8.4 p7
Rsa Authentication Manager	Before 8.4

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.dell.com/support/security/en-us/details/DOC-109297/DSA-2019-168-RSA&#174%3B-Authentication-Manager-Software-Stored-Cross-Site-Scripting-Vulnerability

Source: security_alert@emc.com

https://www.dell.com/support/security/en-us/details/DOC-109297/DSA-2019-168-RSA&#174%3B-Authentication-Manager-Software-Stored-Cross-Site-Scripting-Vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.