6.5
CVE-2019-3768
- EPSS 1.06%
- Veröffentlicht 03.01.2020 23:15:12
- Zuletzt bearbeitet 21.11.2024 04:42:29
- Erkennungen
LoginRSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by supplying specially crafted XML message.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Emc ≫ Rsa Authentication Manager Version < 8.4
Emc ≫ Rsa Authentication Manager Version 8.4 Update -
Emc ≫ Rsa Authentication Manager Version 8.4 Update p1
Emc ≫ Rsa Authentication Manager Version 8.4 Update p2
Emc ≫ Rsa Authentication Manager Version 8.4 Update p3
Emc ≫ Rsa Authentication Manager Version 8.4 Update p4
Emc ≫ Rsa Authentication Manager Version 8.4 Update p5
Emc ≫ Rsa Authentication Manager Version 8.4 Update p6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.06% | 0.6 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| NIST | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
| EMC | 6.5 | 2.8 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
|
CWE-611 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
https://www.dell.com/support/security/en-us/details/DOC-108320/DSA-2019-148-RSA®%3B-Authentication-Manager-Software-XML-Entity-Injection-Vulnerability