Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

RSA Authentication Manager before 8.4 allows unauthorized access via setup

CVE-2018-15782 · published 7 years ago
Summary

Versions of RSA Authentication Manager earlier than 8.4 have a flaw in the Quick Setup process that can be tricked with a specially crafted license file. If an attacker supplies this file during the initial installation, they could gain access to the system without permission. Upgrade to version 8.4 or later, or reinstall using a clean license, to eliminate the risk.

What to do
  • Update rsa authentication_manager to version 8.4 or later.
Affected software
VendorProductAffected versions
rsa authentication_manager < 8.4
cpe:2.3:a:rsa:authentication_manager:*:*:*:*:*:*:*:*
Original advisory text
The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator w...
The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could potentially provide an administrator with a crafted license that if used during the quick setup deployment of the initial RSA Authentication Manager system, could allow the attacker unauthorized access to that system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published16 Jan 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-15782 · NVD
Track software like this
Free during beta