CVE-2016-0902 - CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote atta

CVE-2016-0902

Summary

CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. <a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>

References

Vulnerable Configurations

cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp1:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp1:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_authentication_manager:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_authentication_manager:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_authentication_manager:8.1:sp1:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_authentication_manager:8.1:sp1:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 01-12-2016 - 03:03)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:P/A:N

refmap via4

bugtraq	20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities
misc	http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html
sectrack	1035755

Last major update

01-12-2016 - 03:03

Published

07-05-2016 - 10:59

Last modified

01-12-2016 - 03:03