RSA Authentication Manager 8.7 SP1 False Positive Security Vulnerabilities
a year ago
Originally Published: 2023-05-09
Article Number
000068187
Applies To
RSA Authentication Manager 8.7 SP1
CVE Identifier(s)
CVE-2018-11039, CVE-2020-5421, CVE-2022-22965, CVE-2022-22970
Article Summary

This article provides a list of security vulnerabilities that cannot be exploited on RSA Authentication Manager 8.7 SP1, but which may be flagged by security scanners.

Link to Advisories
Each CVE ID listed can be searched using the following link: https://web.nvd.nist.gov/view/vuln/search . Once there, you can search for each CVE ID referenced in this article for more details.
Alert Impact
Not Exploitable
Alert Impact Explanation
False Positive
Resolution

The vulnerabilities listed in the table below are in order by the date on which RSA Authentication Manager Engineering determined that RSA Authentication Manager 8.7 SP1 was not vulnerable.
 

Embedded ComponentCVE IDSummary of VulnerabilityReason why Product is not VulnerableDate Determined False Positive
spring-web version 3.2.18CVE-2018-11039Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.RSA Authentication Manager 8.7 SP1 is not vulnerable because the product does not use HiddenHttpMethodFilter of spring-web version 3.2.189th May 2023
spring-web version 3.2.18CVE-2020-5421In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.RSA Authentication Manager 8.7 SP1 is not vulnerable because the product uses CSRF filters and provides Content-Disposition header in the response to mitigate this vulnerability.9th May 2023
spring-beans version 3.2.18CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.The exploitation of this vulnerability is only possible with JRE 9 and above, and Apache Tomcat 9. RSA Authentication Manager 8.7 SP1 is not vulnerable because product does not use such a combination of JRE and Tomcat with spring-beans version 3.2.18.9th May 2023
spring-beans version 3.2.18CVE-2022-22970In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.RSA Authentication Manager 8.7 SP1 is not vulnerable because the product does not use MultipartFile of spring-beans version 3.2.18.9th May 2023
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell EMC, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
Attachments
If the attachment does not open when clicked, please refresh the page and try again. You must be logged into view the file(s).
    Don't see what you're looking for?