CVE-2020-5340: XSS
First published: Wed Mar 25 2020(Updated: )
RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators attempt to change the default security domain mapping, the injected scripts could potentially be executed in their browser.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC RSA Authentication Manager | <8.4 | |
| EMC RSA Authentication Manager | =8.4 | |
| EMC RSA Authentication Manager | =8.4-p1 | |
| EMC RSA Authentication Manager | =8.4-p2 | |
| EMC RSA Authentication Manager | =8.4-p3 | |
| EMC RSA Authentication Manager | =8.4-p4 | |
| EMC RSA Authentication Manager | =8.4-p5 | |
| EMC RSA Authentication Manager | =8.4-p6 | |
| EMC RSA Authentication Manager | =8.4-p7 | |
| EMC RSA Authentication Manager | =8.4-p8 | |
| EMC RSA Authentication Manager | =8.4-p9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5340?
CVE-2020-5340 is a stored cross-site scripting vulnerability in RSA Authentication Manager versions prior to 8.4 P10.
What is the severity of CVE-2020-5340?
The severity of CVE-2020-5340 is medium with a CVSS score of 4.8.
How does CVE-2020-5340 affect RSA Authentication Manager?
CVE-2020-5340 affects RSA Authentication Manager versions prior to 8.4 P10.
How can a malicious administrator exploit CVE-2020-5340?
A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit CVE-2020-5340 to store arbitrary HTML or JavaScript code.
Is there a fix available for CVE-2020-5340?
Yes, an update to RSA Authentication Manager version 8.4 P10 or higher addresses the vulnerability.
- collector/nvd-index
- agent/references
- agent/event
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/tags
- agent/remedy
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/emc
- canonical/emc rsa authentication manager
- version/emc rsa authentication manager/8.4
- version/emc rsa authentication manager/8.4-p1
- version/emc rsa authentication manager/8.4-p2
- version/emc rsa authentication manager/8.4-p3
- version/emc rsa authentication manager/8.4-p4
- version/emc rsa authentication manager/8.4-p5
- version/emc rsa authentication manager/8.4-p6
- version/emc rsa authentication manager/8.4-p7
- version/emc rsa authentication manager/8.4-p8
- version/emc rsa authentication manager/8.4-p9