CVE-2020-5339
Vulnerability from cvelistv5
Published
2020-03-25 21:05
Modified
2024-09-17 00:06
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser.
References
security_alert@emc.comhttps://community.rsa.com/docs/DOC-111092Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.rsa.com/docs/DOC-111092Patch, Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:23.357Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.rsa.com/docs/DOC-111092"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RSA Authentication Manager",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "AM 8.4 patch P10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-02-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-31T15:12:36",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.rsa.com/docs/DOC-111092"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2020-02-26",
          "ID": "CVE-2020-5339",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RSA Authentication Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "AM 8.4 patch P10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 4.8,
            "baseSeverity": "Medium",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.rsa.com/docs/DOC-111092",
              "refsource": "MISC",
              "url": "https://community.rsa.com/docs/DOC-111092"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2020-5339",
    "datePublished": "2020-03-25T21:05:14.708471Z",
    "dateReserved": "2020-01-03T00:00:00",
    "dateUpdated": "2024-09-17T00:06:00.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-5339\",\"sourceIdentifier\":\"security_alert@emc.com\",\"published\":\"2020-03-26T13:15:13.407\",\"lastModified\":\"2024-11-21T05:33:56.457\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser.\"},{\"lang\":\"es\",\"value\":\"RSA Authentication Manager versiones anteriores a 8.4 P10, presenta una vulnerabilidad de tipo cross-site scripting almacenado en la Consola de Seguridad. Un administrador malicioso de la Consola de Seguridad de RSA Authentication Manager con privilegios avanzados podr\u00eda explotar esta vulnerabilidad para almacenar c\u00f3digo JavaScript o HTML arbitrario por medio de la interfaz web de la Consola de Seguridad. Cuando otros administradores de la Consola de Seguridad abren la p\u00e1gina de reporte afectada, los scripts inyectados podr\u00edan ser potencialmente ejecutados en su navegador.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}],\"cvssMetricV30\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.4\",\"matchCriteriaId\":\"80B64419-BB7A-4DE7-B563-8C5B93CEEF89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF61F8BF-7483-4A81-9219-EE2465D48182\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"08F52AB3-9C6A-467B-82F9-527956CD7A14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"968CDDC6-703C-44C4-8ACE-EAB208364B0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E450B2C9-FAE5-4450-85D3-7243A1FF3CF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F13BB0FC-951C-42EA-AA63-FF940C5ABCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"478214DC-9A4C-4411-B297-0A4E0B318E15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"45596D96-AC9F-49DC-9AB1-EE979909745A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF18185-558D-4D73-AF46-FEC919752262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D117EE7-2BFC-41F4-AECE-6158A8B0373D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:emc:rsa_authentication_manager:8.4:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"75ADFA4E-FBDC-42F9-985A-FBBE95DA3BCE\"}]}]}],\"references\":[{\"url\":\"https://community.rsa.com/docs/DOC-111092\",\"source\":\"security_alert@emc.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://community.rsa.com/docs/DOC-111092\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.