CVE-2008-6886

RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/32473
http://www.secfault.org/?p=78	Patch
http://secunia.com/advisories/32883	Vendor Advisory
http://www.osvdb.org/50273
http://marc.info/?l=bugtraq&m=122765140110581&w=2	Patch
http://www.vupen.com/english/advisories/2008/3288	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46884

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rsa:envision:3.5.0:::::::*
	cpe:2.3:a:rsa:envision:3.5.1:::::::*
	cpe:2.3:a:rsa:envision:3.5.2:::::::*
	cpe:2.3:a:rsa:envision:3.7.0:::::::*

Information

Published : 2009-08-03 07:30

Updated : 2017-08-16 18:29

NVD link : CVE-2008-6886

Mitre link : CVE-2008-6886

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

rsa

envision

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/32473", "name": "32473", "tags": [], "refsource": "BID"}, {"url": "http://www.secfault.org/?p=78", "name": "http://www.secfault.org/?p=78", "tags": ["Patch"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/32883", "name": "32883", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/50273", "name": "50273", "tags": [], "refsource": "OSVDB"}, {"url": "http://marc.info/?l=bugtraq&m=122765140110581&w=2", "name": "20081125 RSA EnVision Remote Password Disclosure", "tags": ["Patch"], "refsource": "BUGTRAQ"}, {"url": "http://www.vupen.com/english/advisories/2008/3288", "name": "ADV-2008-3288", "tags": ["Patch", "Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46884", "name": "envision-webconsole-info-disclosure(46884)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-6886", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-08-03T14:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:rsa:envision:3.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:rsa:envision:3.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:rsa:envision:3.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:rsa:envision:3.7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:29Z"}