Read the docs
TI-2018-07859 Aliases CVE-2018-11073GHSA-f2f9-3qcv-wjcx

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.

Why it matters now

EPSS 0.0111 66th percentileScored 2026-11-07
Fix Fixed Authentication Manager (RSA): 8.3 P3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSAAuthentication Managerbefore 8.3 P38.3 P3Patch availableCNA
  • Authentication Manager VendorRSA Affected before 8.3 P3 Fixed in 8.3 P3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:*8.3 p1VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:*8.3 p2VulnerableEMC
cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:*up to 8.3VulnerableRSA
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:* Versions 8.3 p1 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:* Versions 8.3 p2 Vulnerable ·EMC
  • cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:* Versions up to 8.3 Vulnerable ·RSA

Remediation

  • Fix · CNA Authentication Manager (RSA) Fixed in 8.3 P3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    RSA Authentication Manager 8.3 P3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2018-07860 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 31
    • TI-2018-07861 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11073
  2. 2026-10-03 Alias added: GHSA-f2f9-3qcv-wjcx

References

Advisory 1

  • TI-2018-01152 XML external entity injection in Dell EMC RSA Authentication Manager Security Console CVSS 3.0HIGH 7.1
  • TI-2019-02732 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability CVSS 3.0HIGH 7.2
  • TI-2018-11257 DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-07860 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.1
  • TI-2012-02018 Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1… CVSS 2.0MEDIUM 6.4
  • TI-2018-01153 Open redirect in Dell EMC RSA Authentication Manager Security Console, Operation Console… CVSS 3.0MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences