CVE-2018-11061
Critical
Description
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges.
SeverityCritical
CVSS9.1
Exploit probability—
ProductEmc Rsa Netwitness
PublishedAug 24, 2018
First seenAug 24, 2018
How to fix
Update
- emc rsa_netwitness11.1.0.2 or later
- emc rsa_security_analytics10.6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc rsa_netwitness | v < 11.1.0.2 | 11.1.0.2 |
| emc rsa_security_analytics | v < 10.6.6 | 10.6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.