« Volver al listado

CVE-2024-25066

Estado: AplazadaMedia (4.3)—

RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

RSA — Authentication ManagerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-25066",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-25066",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-18T16:05:02.913470Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "RSA",
          "product": "Authentication Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8.7 SP2 Patch 1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-17T21:15:10.993",
  "references": [
    {
      "url": "https://community.rsa.com/s/advisories",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://community.rsa.com/s/article/RSA-Authentication-Manager-8-7-SP2-Patch-1-Readme",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/KaiwenTM/CVE_POC/blob/main/CVE-2024-25066.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rsa.com/en-us/company/vulnerability-response-policy",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur."
    },
    {
      "lang": "es",
      "value": "RSA Authentication Manager anterior a la versión 8.7 SP2 Patch 1 permite ataques de entidad externa XML (XXE) a través de un archivo de licencia, lo que hace que los archivos controlados por el atacante se almacenen en el servidor del producto. No se puede producir la exfiltración de datos."
    }
  ],
  "lastModified": "2026-06-17T07:15:26.647",
  "sourceIdentifier": "cve@mitre.org"
}