Lucene search

DellCVE-2018-1234

HistoryMar 30, 2018 - 9:29 p.m.

CVE-2018-1234

2018-03-3021:29:01

CWE-200

dell

web.nvd.nist.gov

rsa

authentication agent

cve-2018-1234

web for iis

acl

windows named pipe

vulnerability

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent.

Affected configurations

Nvd

Node

rsaauthentication_agent_for_webRange≤8.0.1apache_web_server

rsaauthentication_agent_for_webRange≤8.0.1iis

VendorProductVersionCPE
rsaauthentication_agent_for_web*cpe:2.3:a:rsa:authentication_agent_for_web:*:*:*:*:*:apache_web_server:*:*
rsaauthentication_agent_for_web*cpe:2.3:a:rsa:authentication_agent_for_web:*:*:*:*:*:iis:*:*

Vendor	Product	Version	CPE
rsa	authentication_agent_for_web	*	cpe:2.3:a:rsa:authentication_agent_for_web::::::apache_web_server::*
rsa	authentication_agent_for_web	*	cpe:2.3:a:rsa:authentication_agent_for_web::::::iis::*

CNA Affected

[
  {
    "product": "RSA Authentication Agent for Web for IIS",
    "vendor": "Dell EMC",
    "versions": [
      {
        "status": "affected",
        "version": "version 8.0.1 and earlier"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2018/Mar/60

www.securitytracker.com/id/1040577

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2018-1234