CVE-2005-1118 Cross-site scripting in n/a

What is CVE-2005-1118?

CVE-2005-1118 is a medium-severity cross-site scripting vulnerability in n/a, published on 16 Apr 2005. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in IISWebAgentIF.dll in the RSA Authentication Agent for Web 5.2 allows remote attackers to inject arbitrary web script or HTML via the postdata parameter.

Which versions are affected by CVE-2005-1118?

It affects 1 product.

Products include Rsa Authentication Agent for Web.

How do I fix CVE-2005-1118?

No fix has been published for CVE-2005-1118 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2005-1118 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-1118 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2017-14377 Auth bypass in RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 Critical 9.8
• CVE-2018-1232 Memory corruption in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server High 7.5
• CVE-2005-4734 Memory corruption in n/a Medium 6.4
• CVE-2018-1233 Cross-site scripting in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server Medium 6.1
• CVE-2018-1234 Information disclosure in RSA Authentication Agent for Web for IIS Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rrrg-fj7x-7r76.