TI-2018-01158 Aliases CVE-2018-1253 GHSA-cjcj-55rf-3pcm

Stored cross-site scripting in RSA Authentication Manager

LOW 30CWE-79Published 2018-06-21 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.

Why it matters now

EPSS 0.01449 73rd percentileScored 2026-11-07

Fix Fixed Authentication Manager (RSA): 8.3 P1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RSA	Authentication Manager	before 8.3 P1	8.3 P1	Patch available	CNA

Authentication Manager VendorRSA Affected before 8.3 P1 Fixed in 8.3 P1 Patch available CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:emc:rsa_authentication_manager::::::::	up to 7.0	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:-::::::	7.1	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp2::::::	7.1 sp2	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp3::::::	7.1 sp3	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp4::::::	7.1 sp4	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.0:-::::::	8.0	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.0:p1::::::	8.0 p1	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.1:-::::::	8.1	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.1:sp1::::::	8.1 sp1	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:-::::::	8.2	Vulnerable	EMC

cpe:2.3:a:emc:rsa_authentication_manager:*:*:*:*:*:*:*:* Versions up to 7.0 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp2:*:*:*:*:*:* Versions 7.1 sp2 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp3:*:*:*:*:*:* Versions 7.1 sp3 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp4:*:*:*:*:*:* Versions 7.1 sp4 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.0:p1:*:*:*:*:*:* Versions 8.0 p1 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.1:-:*:*:*:*:*:* Versions 8.1 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.1:sp1:*:*:*:*:*:* Versions 8.1 sp1 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.2:-:*:*:*:*:*:* Versions 8.2 Vulnerable ·EMC

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1::::::	8.2 sp1	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:-::::::	8.3	Vulnerable	EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1::::::	8.3 p1	Vulnerable	EMC

cpe:2.3:a:emc:rsa_authentication_manager:8.2:sp1:*:*:*:*:*:* Versions 8.2 sp1 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:-:*:*:*:*:*:* Versions 8.3 Vulnerable ·EMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:* Versions 8.3 p1 Vulnerable ·EMC

Remediation

Fix · CNA Authentication Manager (RSA) Fixed in 8.3 P1

Timeline

2026-10-02 Threatist record created from CVE-2018-1253
2026-10-03 Alias added: GHSA-cjcj-55rf-3pcm

References

Advisory 1

20180612 DSA-2018-107: RSA Authentication Manager Cross-site scripting Vulnerabilities

TI-2005-04464 Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka… CVSS 2.0MEDIUM 6.4
TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
TI-2024-16531 XML external entity injection in RSA Authentication Manager CVSS 3.1MEDIUM 4.3
TI-2024-32115 In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be… CVSS 3.1CRITICAL 9.8
TI-2018-07844 Out-of-bounds read in RSA BSAFE Micro Edition Suite CVSS 3.1CRITICAL 9.8
TI-2017-10489 Improper authentication in RSA Authentication Agent for Web for Apache Web Server RSA… CVSS 3.0CRITICAL 9.8

See all 125 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences