CVE-2020-5346

Опубликовано: 15 апр. 2020

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

RSA Authentication Manager versions prior to 8.4 P11 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected page, the injected scripts could potentially be executed in their browser.

Ссылки

https://community.rsa.com/docs/DOC-111347
Patch
Vendor Advisory
https://community.rsa.com/docs/DOC-111347
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:*

Версия до 8.3 (включая)

cpe:2.3:a:emc:rsa_authentication_manager:8.4:-:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p1:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p10:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p2:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p3:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p4:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p5:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p6:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p7:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p8:*:*:*:*:*:*

cpe:2.3:a:emc:rsa_authentication_manager:8.4:p9:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00289

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-m257-p3ch-g723