// For flags

CVE-2018-15782

DSA-2018-226: RSA® Authentication Manager Relative Path Traversal Vulnerability

Severity Score

7.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authentication Manager system, could allow the attacker unauthorized access to that system.

El componente Quick Setup de las versiones anteriores a la 8.4 de RSA Authentication Manager es vulnerable a un salto de directorio relativo. Un atacante local podría proporcionar una licencia manipulada a un administrador que, si se emplea durante el despliegue de la instalación rápida del sistema inicial de RSA Authentication Manager, podría permitir que el atacante obtenga acceso no autorizado a dicho sistema.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-08-23 CVE Reserved
  • 2019-01-07 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (1)
URL Tag Source
https://seclists.org/fulldisclosure/2019/Jan/18 Mailing List
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rsa
Search vendor "Rsa"
 Authentication Manager
Search vendor "Rsa" for product "Authentication Manager"
 < 8.4
Search vendor "Rsa" for product "Authentication Manager" and version " < 8.4"
-
Affected