Read the docs
TI-2017-11362 Aliases CVE-2017-15546GHSA-m387-hmw2-cmf7

SQL injection in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier

Priority LOW 22CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database.

Why it matters now

EPSS 0.01179 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—EMC RSA Authentication Manager 8.2 SP1 P6 and earlierEMC RSA Authentication Manager 8.2 SP1 P6 and earlier—No fix listedCNA
  • EMC RSA Authentication Manager 8.2 SP1 P6 and earlier Vendor— Affected EMC RSA Authentication Manager 8.2 SP1 P6 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:*up to 8.2VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1:*:*:*:*:*:*8.2 sp1VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p1:*:*:*:*:*:*8.2 sp1_p1VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p2:*:*:*:*:*:*8.2 sp1_p2VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p3:*:*:*:*:*:*8.2 sp1_p3VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p4:*:*:*:*:*:*8.2 sp1_p4VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p5:*:*:*:*:*:*8.2 sp1_p5VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p6:*:*:*:*:*:*8.2 sp1_p6VulnerableEMC
  • cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:* Versions up to 8.2 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1:*:*:*:*:*:* Versions 8.2 sp1 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p1:*:*:*:*:*:* Versions 8.2 sp1_p1 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p2:*:*:*:*:*:* Versions 8.2 sp1_p2 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p3:*:*:*:*:*:* Versions 8.2 sp1_p3 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p4:*:*:*:*:*:* Versions 8.2 sp1_p4 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p5:*:*:*:*:*:* Versions 8.2 sp1_p5 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1_p6:*:*:*:*:*:* Versions 8.2 sp1_p6 Vulnerable ·EMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15546
  2. 2026-10-03 Alias added: GHSA-m387-hmw2-cmf7

References

Advisory 1

  • TI-2019-02732 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability CVSS 3.0HIGH 7.2
  • TI-2019-02783 XML external entity injection in Dell RSA Authentication Manager CVSS 3.1MEDIUM 6.5
  • TI-2018-07860 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.1
  • TI-2018-07859 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.5
  • TI-2018-01159 Cross-site scripting in RSA Authentication Manager CVSS 3.0MEDIUM 6.1
  • TI-2017-05607 Improper authentication in RSA Authentication Manager 8.2 SP1 Patch 1 and earlier CVSS 3.0MEDIUM 5.9
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences