Maple Labs

CVE search · CVE-2018-11061

CVE-2018-11061

critical 9.1

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
security_alert@emc.com
Weakness
NVD-CWE-noinfo

Severity

VersionScoreVectorSource
CVSS 3.0 critical 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H security_alert@emc.comSecondary
CVSS 3.0 critical 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 high 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • emc · rsa_netwitness
  • emc · rsa_security_analytics

References