CVE-2017-8000

{"containers": {"cna": {"affected": [{"product": "RSA Authentication Manager 8.2 SP1 and earlier", "vendor": "n/a", "versions": [{"status": "affected", "version": "RSA Authentication Manager 8.2 SP1 and earlier"}]}], "datePublic": "2017-07-17T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session."}], "problemTypes": [{"descriptions": [{"description": "Stored Cross-Site Scripting Vulnerabilities", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-18T09:57:01.000Z", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"name": "1038878", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038878"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://seclists.org/fulldisclosure/2017/Jul/25"}, {"name": "99572", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99572"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2017-8000", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "RSA Authentication Manager 8.2 SP1 and earlier", "version": {"version_data": [{"version_value": "RSA Authentication Manager 8.2 SP1 and earlier"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Stored Cross-Site Scripting Vulnerabilities"}]}]}, "references": {"reference_data": [{"name": "1038878", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038878"}, {"name": "http://seclists.org/fulldisclosure/2017/Jul/25", "refsource": "CONFIRM", "url": "http://seclists.org/fulldisclosure/2017/Jul/25"}, {"name": "99572", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99572"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:19:29.488Z"}, "title": "CVE Program Container", "references": [{"name": "1038878", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038878"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2017/Jul/25"}, {"name": "99572", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99572"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2017-8000", "datePublished": "2017-07-17T14:00:00.000Z", "dateReserved": "2017-04-21T00:00:00.000Z", "dateUpdated": "2024-08-05T16:19:29.488Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "RSA Authentication Manager 8.2 SP1 and earlier", "vendor": "n/a", "versions": [{"status": "affected", "version": "RSA Authentication Manager 8.2 SP1 and earlier"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emc:rsa_authentication_manager:*:sp1:*:*:*:*:*:*", "matchCriteriaId": "8A7D03E1-0EEF-4E76-ADEF-39A302C6DD13", "versionEndIncluding": "8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session."}, {"lang": "es", "value": "En RSA Authentication Manager versi\u00f3n 8.2 SP1 y anteriores de EMC, un Administrador de la Consola de Seguridad de RSA malicioso podr\u00eda crear un perfil de token y almacenar el nombre del perfil en la base de datos de RSA Authentication Manager. El nombre del perfil podr\u00eda incluir un script creado (con una carga de tipo XSS) que podr\u00eda ser ejecutada al visualizar o editar el perfil del token asignado en el token por la sesi\u00f3n del navegador de otro administrador."}], "id": "CVE-2017-8000", "lastModified": "2026-06-17T01:25:37.310", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-17T14:29:01.107", "references": [{"source": "security_alert@emc.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Jul/25"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99572"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038878"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Jul/25"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99572"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038878"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}