CVE-2020-5384

Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability by using an alternate path to bypass authentication in order to gain full access to the system.

CVSS v3 8.4 HIGH
CVSS v2.0 7.2 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://community.rsa.com/docs/DOC-113541	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rsa:multifactor_authentication_agent:2.0:*:*:*:*:windows:*:*

History

No history.

Information

Published : 2020-07-31 18:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-5384

Mitre link : CVE-2020-5384

CVE.ORG link : CVE-2020-5384

JSON object : View

Products Affected

rsa

multifactor_authentication_agent

CWE

CWE-287

Improper Authentication

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2020-5384", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2020-07-31T18:15:15.723", "references": [{"url": "https://community.rsa.com/docs/DOC-113541", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability by using an alternate path to bypass authentication in order to gain full access to the system."}, {"lang": "es", "value": "Una Vulnerabilidad de Omisi\u00f3n de Autenticaci\u00f3n de RSA MFA Agent versi\u00f3n 2.0 para Microsoft Windows, contiene una vulnerabilidad de Omisi\u00f3n de Autenticaci\u00f3n. Un atacante no autenticado local podr\u00eda potencialmente explotar esta vulnerabilidad mediante el uso de una ruta alterna para omitir la autenticaci\u00f3n a fin de conseguir acceso completo al sistema"}], "lastModified": "2020-08-11T17:29:43.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rsa:multifactor_authentication_agent:2.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "5D04CF51-F1D5-4A0E-B14C-1A2F7FDAF3AB"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}