CVE-2018-1253

MEDIUM

RSA Authentication Manager <= 8.3 P1 - Stored Cross-Site Scripting via Operation Console

Title source: llm

Description

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/104534

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041134

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2018/Jun/39

Scores

CVSS v3 6.1

EPSS 0.0035

EPSS Percentile 57.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (6)

emc/rsa_authentication_manager 7.1 (4 CPE variants)

emc/rsa_authentication_manager 8.0 (2 CPE variants)

emc/rsa_authentication_manager 8.1 (2 CPE variants)

emc/rsa_authentication_manager 8.2 (2 CPE variants)

emc/rsa_authentication_manager 8.3 (2 CPE variants)

emc/rsa_authentication_manager < 7.0

Published Jun 21, 2018

Tracked Since Feb 18, 2026