Read the docs
TI-2018-01159 Aliases CVE-2018-1254GHSA-qq7j-p73v-w7cg

Cross-site scripting in RSA Authentication Manager

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.

Why it matters now

EPSS 0.01986 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSARSA Authentication Managerup to 8.3 P1—No fix listedCNA
  • RSA Authentication Manager VendorRSA Affected up to 8.3 P1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:emc:rsa_authentication_manager:*:p1:*:*:*:*:*:*up to 8.3VulnerableEMC
  • cpe:2.3:a:emc:rsa_authentication_manager:*:p1:*:*:*:*:*:* Versions up to 8.3 Vulnerable ·EMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1254
  2. 2026-10-03 Alias added: GHSA-qq7j-p73v-w7cg

References

Advisory 1

  • TI-2005-04464 Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka… CVSS 2.0MEDIUM 6.4
  • TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
  • TI-2024-16531 XML external entity injection in RSA Authentication Manager CVSS 3.1MEDIUM 4.3
  • TI-2024-32115 In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be… CVSS 3.1CRITICAL 9.8
  • TI-2018-07844 Out-of-bounds read in RSA BSAFE Micro Edition Suite CVSS 3.1CRITICAL 9.8
  • TI-2017-10489 Improper authentication in RSA Authentication Agent for Web for Apache Web Server RSA… CVSS 3.0CRITICAL 9.8
See all 125 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences