Login Request a demo
Medium severity · published Jun 21, 2018
CVE-2018-1253
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability
6.1
CVSS
1.5%
EPSS
No
On KEV
Description
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rsa Authentication Manager · Emc
through 7.0; 7.1; 7.1; 7.1; 7.1; 8.0; +7 more · source: NVD
Affected product
RA
Rsa Authentication Manager
Emc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1253
Mailing List
http://seclists.org/fulldisclosure/2018/Jun/39
Third Party Advisory
http://www.securityfocus.com/bid/104534
Third Party Advisory
http://www.securitytracker.com/id/1041134
More from Rsa Authentication Manager
7.2
CVE-2019-3711
DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability
6.5
CVE-2019-3768
RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability
6.1
CVE-2018-11074
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files
6.1
CVE-2018-1254
RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability
6.1
CVE-2017-14373
EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise…