CVE-2019-3711 in RSA Authentication Manager
Summary
by MITRE
RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2023
The RSA Authentication Manager authentication system presents a critical insecure credential management vulnerability that affects versions prior to 8.4 P1. This flaw resides in the way the system handles domain password storage and retrieval within the Operations Console environment. The vulnerability stems from inadequate protection mechanisms that allow unauthorized credential access between administrators, creating a significant security risk in enterprise authentication infrastructure.
The technical implementation of this vulnerability involves the improper handling of credential persistence within the RSA Authentication Manager console. When domain passwords are set by one administrator, the system fails to adequately secure these credentials from access by other administrators who possess sufficient privileges to interact with the console. This insecure credential management approach violates fundamental security principles and creates an attack surface where malicious actors can extract and reuse domain passwords. The flaw operates at the credential storage level, where password values are not properly encrypted or isolated during their lifecycle within the console environment.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables privilege escalation attacks and persistent access to enterprise authentication systems. An attacker with operations console administrator privileges can exploit this weakness to obtain domain passwords that were previously configured by other administrators, potentially gaining access to multiple domains and systems within the organization's authentication infrastructure. This vulnerability undermines the principle of least privilege and creates a pathway for attackers to establish long-term access to critical authentication services.
Organizations should implement immediate mitigations including upgrading to RSA Authentication Manager version 8.4 P1 or later, which addresses the insecure credential management flaw through enhanced encryption and access controls. Additional protective measures include implementing strict administrative access controls, monitoring console activities for unauthorized credential access attempts, and establishing robust audit trails for all administrative operations. The vulnerability aligns with CWE-522, which addresses insufficiently protected credentials, and maps to ATT&CK technique T1078.002 for Valid Accounts: Domain Accounts, as it enables unauthorized access to legitimate administrative credentials. Security teams should also consider implementing additional monitoring controls to detect anomalous administrative activities and ensure proper segregation of duties among authentication administrators.