DSA-2018-152

Típus: Hírek
Publikálva: 19/09/2018
Az érintett verziók:
- RSA Authentication Manager 8.3 Patch 3-nál régebbi verziók
- RSA Authentication Manager web-tier server 8.3 Patch 3-nál régebbi verziók
- RSA Authentication Manager Language Pack 8.3 Patch 3-nál régebbi verziók (csak CVE-2018-11074) 

A sérülékenyséegek listája:
- Stored Cross-Site Scripting (CVE 2018-11073) - RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser. - CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)
- DOM-Based Cross-Site Scripting (CVE-2018-11074) - RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application. - CVSSv3 Base Score 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- Reflected Cross-Site Scripting (CVE-2018-11075) - RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application. - CVSSv3 Base SCore: 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L)


Javasolt telepíeni a 8.3 Patch 3 verziókat.

Kapcsolat

+36 1 371 2 370
rsa.ecs.hu@arrow.com

 CL Social Media Icon - Facebook 40px CL Social Media Icon - Twitter 40px CL Social Media Icon - Blog 40px  YouTube_40