FKIE_CVE-2011-2733

Vulnerability from fkie_nvd - Published: 2011-08-18 23:55 - Updated: 2026-06-16 23:31
Severity
Summary
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not prevent reuse of authentication information during a session, which allows remote authenticated users to bypass intended access restrictions via vectors related to knowledge of the originally used authentication information and unspecified other session information.
References
security_alert@emc.comhttp://securityreason.com/securityalert/8344
security_alert@emc.comhttp://www.securityfocus.com/archive/1/519346/100/0/threaded
security_alert@emc.comhttp://www.securityfocus.com/bid/49574
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8344
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/519346/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/49574
Impacted products
Vendor Product Version
emc rsa_adaptive_authentication_on-premise 6.0.2.1
emc rsa_adaptive_authentication_on-premise 6.0.2.1
emc rsa_adaptive_authentication_on-premise 6.0.2.1
emc rsa_adaptive_authentication_on-premise 6.0.2.1
emc rsa_adaptive_authentication_on-premise 6.0.2.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "security_alert@emc.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch2:*:*:*:*:*:*",
              "matchCriteriaId": "F97E490D-12E8-420C-990E-2BB4B97D86D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp1_patch3:*:*:*:*:*:*",
              "matchCriteriaId": "7E18C647-3264-46A0-8411-4DB02E470217",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "30CE0F82-18A5-4E1F-B096-8A85AF85F4C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp2_patch1:*:*:*:*:*:*",
              "matchCriteriaId": "250D48AB-3B67-402F-AE85-DF8B12E10D32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emc:rsa_adaptive_authentication_on-premise:6.0.2.1:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "504CA1D2-9915-4ABF-9D08-C8ED5F86F34A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not prevent reuse of authentication information during a session, which allows remote authenticated users to bypass intended access restrictions via vectors related to knowledge of the originally used authentication information and unspecified other session information."
    },
    {
      "lang": "es",
      "value": "EMC RSA Adaptive Authentication On-Premise (AAOP) v6.0.2.1 SP1 Patch2, SP1 Patch3, SP2, SP2 Patch1 y Service Pack 3 no impide la reutilizaci\u00f3n de la informaci\u00f3n de autenticaci\u00f3n durante una sesi\u00f3n, lo que permite eludir las restricciones de acceso, a usuarios remotos autenticados, a trav\u00e9s de vectores relacionados con el conocimiento de la informaci\u00f3n de autenticaci\u00f3n utilizado originalmente y con informaci\u00f3n de sesi\u00f3n no especificada."
    }
  ],
  "evaluatorSolution": "Per: http://www.securityfocus.com/archive/1/archive/1/519346/100/0/threaded\r\n\r\n\r\nWe strongly recommend that RSA customers should obtain the following hot fixes:\r\n\r\nRSA AAOP 6.0.2.1 SP1 Patch 2 customers should obtain Hotfix 430 from SecurCare Online.\r\n\r\nRSA AAOP 6.0.2.1 SP1 Patch 3 customers should obtain Hotfix 130 from SecurCare Online.\r\n\r\nRSA AAOP 6.0.2.1 SP2 customers should obtain Hotfix 360 from SecurCare Online.\r\n\r\nRSA AAOP 6.0.2.1 SP2 Patch 1 customers should obtain Hotfix 140 from SecurCare Online.\r\n\r\nRSA AAOP 6.0.2.1 SP3 customers should obtain Hotfix 130 from SecurCare Online.\r\n",
  "id": "CVE-2011-2733",
  "lastModified": "2026-06-16T23:31:53.653",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 8.5,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-08-18T23:55:00.710",
  "references": [
    {
      "source": "security_alert@emc.com",
      "url": "http://securityreason.com/securityalert/8344"
    },
    {
      "source": "security_alert@emc.com",
      "url": "http://www.securityfocus.com/archive/1/519346/100/0/threaded"
    },
    {
      "source": "security_alert@emc.com",
      "url": "http://www.securityfocus.com/bid/49574"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8344"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/519346/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/49574"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.