Read the docs
TI-2018-07837 Aliases CVE-2018-11051GHSA-pphw-x8fq-53rc

RSA Certificate Manager Path Traversal Vulnerability

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.

Why it matters now

EPSS 0.02605 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSACertificate Manager Path Traversal Vulnerability6.9 build 560 through 6.9 build 564—No fix listedCNA
  • Certificate Manager Path Traversal Vulnerability VendorRSA Affected 6.9 build 560 through 6.9 build 564 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:emc:rsa_certificate_manager:*:*:*:*:*:*:*:*up to 6.9VulnerableEMC
  • cpe:2.3:a:emc:rsa_certificate_manager:*:*:*:*:*:*:*:* Versions up to 6.9 Vulnerable ·EMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11051
  2. 2026-10-03 Alias added: GHSA-pphw-x8fq-53rc

References

Advisory 1

  • TI-2005-04464 Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka… CVSS 2.0MEDIUM 6.4
  • TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
  • TI-2024-16531 XML external entity injection in RSA Authentication Manager CVSS 3.1MEDIUM 4.3
  • TI-2024-32115 In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be… CVSS 3.1CRITICAL 9.8
  • TI-2018-07844 Out-of-bounds read in RSA BSAFE Micro Edition Suite CVSS 3.1CRITICAL 9.8
  • TI-2017-10489 Improper authentication in RSA Authentication Agent for Web for Apache Web Server RSA… CVSS 3.0CRITICAL 9.8
See all 125 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences