Auth bypass in Rsa Access Manager Agent

CVE-2012-2281

EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.

Vulnerability class: Broken Authentication

EPSS: 0.007 (48.7th percentile) — read the EPSS interpretation.

Affected products

Rsa Access_manager_agent
Rsa Access_manager_server — versions 6.0, 6.1
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)
security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)