Medium severity · published Dec 23, 2015
CVE-2015-6851
EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running…
6.7
CVSS
0.6%
EPSS
No
On KEV
Description
EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Securid Web Agent · Rsa
through 7.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6851
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6851
packetstormsecurity.com
http://packetstormsecurity.com/files/135013/RSA-SecurID-Web-Agent-Authentication-Bypass.html
seclists.org
http://seclists.org/bugtraq/2015/Dec/115
www.securityfocus.com
http://www.securityfocus.com/bid/79646
www.securitytracker.com
http://www.securitytracker.com/id/1034510
More from Securid Web Agent
–
CVE-2013-0941
EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before…
–
CVE-2005-1471
Heap-based buffer overflow in RSA SecurID Web Agent 5, 5.2, and 5.3 allows remote attackers to execute arbitrary code via crafted chunked-encoding data