CVE-2018-1234

Опубликовано: 30 мар. 2018

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent.

Ссылки

http://seclists.org/fulldisclosure/2018/Mar/60
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1040577
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Mar/60
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1040577
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rsa:authentication_agent_for_web:*:*:*:*:*:apache_web_server:*:*

Версия до 8.0.1 (включая)

cpe:2.3:a:rsa:authentication_agent_for_web:*:*:*:*:*:iis:*:*

Версия до 8.0.1 (включая)

EPSS

Процентиль: 29%

0.00106

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-34m7-5gf2-rcmj