Vulnerability Details : CVE-2020-5340
RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators attempt to change the default security domain mapping, the injected scripts could potentially be executed in their browser.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2020-5340
- cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:-:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p1:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p2:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p3:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p4:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p5:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p6:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p7:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p8:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:8.4:p9:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5340
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5340
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
|
4.8
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
1.7
|
2.7
|
Dell | |
|
4.8
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
1.7
|
2.7
|
NIST |
CWE ids for CVE-2020-5340
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)
References for CVE-2020-5340
-
https://community.rsa.com/docs/DOC-111092
DSA-2020-052: RSA® Authentication Manager ... | RSA LinkPatch;Vendor Advisory
Jump to