CVE-2018-1253

CVE-2018-1253 describes a stored cross-site scripting (XSS) vulnerability in RSA Authentication Manager Operation Console versions 8.3 P1 and earlier. A malicious Operations Console administrator could inject arbitrary HTML or JavaScript code into the web interface. This injected code would then execute in the browsers of other administrators viewing the compromised page, potentially leading to information disclosure or unauthorized actions. The vulnerability has a CVSS v3.1 score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. Despite being a medium severity issue, it has a very low EPSS score, suggesting a low probability of exploitation in the wild. Currently, there is no known active exploitation, publicly available exploit code (e.g., Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. It is not listed in CISA's Known Exploited Vulnerabilities Catalog.