Unscored severity · published Aug 3, 2009
CVE-2008-6886
RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator…
–
CVSS
1.5%
EPSS
No
On KEV
Description
RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Envision · Rsa
3.5.0; 3.5.1; 3.5.2; 3.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6886
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6886
Patch
http://marc.info/?l=bugtraq&m=122765140110581&w=2
Vendor Advisory
http://secunia.com/advisories/32883
www.osvdb.org
http://www.osvdb.org/50273
Patch
http://www.secfault.org/?p=78
www.securityfocus.com
http://www.securityfocus.com/bid/32473
Patch
http://www.vupen.com/english/advisories/2008/3288
More from Envision
–
CVE-2012-0403
Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vectors
–
CVE-2012-0402
EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors
–
CVE-2012-0401
Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors
–
CVE-2012-0400
EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to obtain access via a…
–
CVE-2012-0399
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified…