CVE-2012-2280
CVE-2012-2280 is a medium-severity vulnerability in Emc Rsa Authentication Manager with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 1% (61st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Emc Rsa Authentication Manager
- Published:
- Last modified:
Description
EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
Frequently asked questions
- What is CVE-2012-2280?
- EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
- How severe is CVE-2012-2280?
- CVE-2012-2280 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2012-2280 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2012-2280?
- CVE-2012-2280 primarily affects Emc Rsa Authentication Manager. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2012-2280?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2012-2280 published?
- CVE-2012-2280 was published on 2012-07-13 and last updated on 2026-06-16.
References
Affected products (12)
- cpe:2.3:a:emc:rsa_authentication_manager:*:sp4:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:emc:rsa_authentication_manager:7.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:rsa:authentication_manager:7.1:sp42:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:3.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:3.0:sp3:*:*:*:*:*:*
- cpe:2.3:a:rsa:securid_appliance:3.0:sp4:*:*:*:*:*:*
More vulnerabilities in Emc Rsa Authentication Manager
- CVE-2019-3768 — Medium (CVSS 6.5): RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote…
- CVE-2018-11073 — Medium (CVSS 6.5): RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the…
- CVE-2012-2279 — Medium (CVSS 6.4): Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA…
- CVE-2018-11074 — Medium (CVSS 6.1): RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability…
- CVE-2018-1254 — Medium (CVSS 6.1): RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting…
- CVE-2018-1253 — Medium (CVSS 6.1): RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting…