Read the docs
TI-2018-07861 Aliases CVE-2018-11075GHSA-wmw5-q7mq-29g9

DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application.

Why it matters now

EPSS 0.0149 74th percentileScored 2026-11-07
Fix Fixed Authentication Manager (RSA): 8.3 P3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSAAuthentication Managerbefore 8.3 P38.3 P3Patch availableCNA
  • Authentication Manager VendorRSA Affected before 8.3 P3 Fixed in 8.3 P3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:*up to 8.3VulnerableRSA
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:*8.3 p1VulnerableEMC
cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:*8.3 p2VulnerableEMC
  • cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:* Versions up to 8.3 Vulnerable ·RSA
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p1:*:*:*:*:*:* Versions 8.3 p1 Vulnerable ·EMC
  • cpe:2.3:a:emc:rsa_authentication_manager:8.3:p2:*:*:*:*:*:* Versions 8.3 p2 Vulnerable ·EMC

Remediation

  • Fix · CNA Authentication Manager (RSA) Fixed in 8.3 P3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    RSA Authentication Manager 8.3 P3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2018-07860 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 31
    • TI-2018-07859 DSA-2018-152: RSA® Authentication Manager Multiple VulnerabilitiesPriority LOW 31
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11075
  2. 2026-10-03 Alias added: GHSA-wmw5-q7mq-29g9

References

Advisory 1

  • TI-2018-01152 XML external entity injection in Dell EMC RSA Authentication Manager Security Console CVSS 3.0HIGH 7.1
  • TI-2019-02732 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability CVSS 3.0HIGH 7.2
  • TI-2018-11257 DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-07860 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.1
  • TI-2018-07859 DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities CVSS 3.0MEDIUM 6.5
  • TI-2012-02018 Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1… CVSS 2.0MEDIUM 6.4
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences