TI-2017-10489 Aliases CVE-2017-14377 GHSA-h8gf-gcf3-7w52

Improper authentication in RSA Authentication Agent for Web for Apache Web Server RSA…

MEDIUM 48CWE-287Published 2017-11-29 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 have a security vulnerability that could potentially lead to authentication bypass.

Why it matters now

EPSS 0.03033 87th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618	RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618	—	No fix listed	CNA

RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 Vendor— Affected RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:rsa:authentication_agent_for_web:8.0:::::apache_web_server::	8.0	Vulnerable	RSA
cpe:2.3:a:rsa:authentication_agent_for_web:8.0.1:::::apache_web_server::	8.0.1	Vulnerable	RSA

cpe:2.3:a:rsa:authentication_agent_for_web:8.0:*:*:*:*:apache_web_server:*:* Versions 8.0 Vulnerable ·RSA
cpe:2.3:a:rsa:authentication_agent_for_web:8.0.1:*:*:*:*:apache_web_server:*:* Versions 8.0.1 Vulnerable ·RSA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-14377
2026-10-03 Alias added: GHSA-h8gf-gcf3-7w52

References

Advisory 1

http://seclists.org/fulldisclosure/2017/Nov/46

TI-2005-04464 Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka… CVSS 2.0MEDIUM 6.4
TI-2018-01138 Out-of-bounds write in Dell EMC RSA Authentication Agent for Web for IIS, RSA… CVSS 3.0HIGH 7.5
TI-2018-01139 Cross-site scripting in Dell EMC RSA Authentication Agent for Web for IIS, RSA… CVSS 3.0MEDIUM 6.1
TI-2010-03118 Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web… CVSS 2.0MEDIUM 5.0
TI-2018-01140 Information disclosure in Dell EMC RSA Authentication Agent for Web for IIS CVSS 3.0MEDIUM 5.5
TI-2005-01056 Cross-site scripting (XSS) vulnerability in IISWebAgentIF.dll in the RSA Authentication… CVSS 2.0MEDIUM 4.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences