CVE-2005-3329 Cross-site scripting in n/a

What is CVE-2005-3329?

CVE-2005-3329 is a medium-severity cross-site scripting vulnerability in n/a, published on 27 Oct 2005. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in RSA Authentication Agent for Web 5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter in a GetPic operation.

Which versions are affected by CVE-2005-3329?

It affects 1 product.

Products include Rsa Authentication Agent for Web.

How do I fix CVE-2005-3329?

No fix has been published for CVE-2005-3329 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2005-3329 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-3329 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2017-14377 Auth bypass in RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 Critical 9.8
• CVE-2018-1232 Memory corruption in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server High 7.5
• CVE-2005-4734 Memory corruption in n/a Medium 6.4
• CVE-2018-1233 Cross-site scripting in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server Medium 6.1
• CVE-2018-1234 Information disclosure in RSA Authentication Agent for Web for IIS Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-92g8-wx97-r4qc.