CVE-2018-1248

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulnerability. This could allow a remote attacker to potentially poison HTTP cache and subsequently redirect users to arbitrary web domains.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Dell EMC	RSA Authentication Manager Security Console, Operation Console and Self-Service Console	version 8.3 and earlier

References

http://seclists.org/fulldisclosure/2018/May/18Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104113Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040835Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/May/18Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104113Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040835Third Party Advisory, VDB Entry

Timeline

Published: May 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124806.1Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.CVE-2018-124819.8The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the CVE-2018-124828.8OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.CVE-2018-124838.8OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdisco CVE-2018-12495.9Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man CVE-2018-124919.8PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by CVE-2018-124927.5PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.CVE-2018-124936.5An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cm CVE-2018-124946.5An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cm CVE-2018-124955.5The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based b CVE-2018-124989.8spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.CVE-2018-124997.4The Motorola MBP853 firmware does not correctly validate server certificates. This allows for a Man in The Middle (MiTM) attack to take plac