Read the docs
TI-2018-07860 Aliases CVE-2018-11074GHSA-9c4w-63hf-q5w2

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application.

Why it matters now

EPSS 0.02027 81st percentileScored 2026-11-07
Fix Fixed Authentication Manager (RSA): 8.3 P3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSAAuthentication Managerbefore 8.3 P38.3 P3Patch availableCNA
  • Authentication Manager VendorRSA Affected before 8.3 P3 Fixed in 8.3 P3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:*up to 8.3VulnerableRSA
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:*8.3 p1VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:*8.3 p2VulnerableEMC
  • cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:* Versions up to 8.3 Vulnerable ·RSA
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:* Versions 8.3 p1 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:* Versions 8.3 p2 Vulnerable ·EMC

Remediation

  • Fix · CNA Authentication Manager (RSA) Fixed in 8.3 P3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    RSA Authentication Manager 8.3 P3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2018-07859 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 31
    • TI-2018-07861 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11074
  2. 2026-10-03 Alias added: GHSA-9c4w-63hf-q5w2

References

Advisory 1

  • TI-2018-01152 XML external entity injection in Dell EMC RSA Authentication Manager Security Console CVSS 3.0HIGH 7.1
  • TI-2019-02732 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability CVSS 3.0HIGH 7.2
  • TI-2018-11257 DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-07859 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.5
  • TI-2012-02018 Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1… CVSS 2.0MEDIUM 6.4
  • TI-2018-01153 Open redirect in Dell EMC RSA Authentication Manager Security Console, Operation Console… CVSS 3.0MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences