ID |
CVE-2018-11061
|
Summary |
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:emc:rsa_netwitness:9.8.5.17:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_netwitness:9.8.5.17:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_netwitness:9.8.5.19:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_netwitness:9.8.5.19:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.0:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.0:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.1:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.2:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.2.3:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.2.3:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.2.4:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.2.4:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.3:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.3:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.3.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.3.1:*:*:*:*:*:*:*
-
cpe:2.3:a:emc:rsa_security_analytics:10.3.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_security_analytics:10.3.2:*:*:*:*:*:*:*
|
CVSS |
Base: | 9.0 (as of 09-10-2019 - 23:33) |
Impact: | |
Exploitability: | |
|
CWE |
NVD-CWE-noinfo |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
SINGLE |
|
Impact |
Confidentiality | Integrity | Availability |
COMPLETE |
COMPLETE |
COMPLETE |
|
cvss-vector
via4
|
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
refmap
via4
|
bid | 105134 | fulldisc | 20180814 DSA-2018-132: RSA NetWitness Platform Server-Side Template Injection Vulnerability | sectrack | |
|
Last major update |
09-10-2019 - 23:33 |
Published |
24-08-2018 - 15:29 |
Last modified |
09-10-2019 - 23:33 |