{"api_version":"1","generated_at":"2026-07-23T13:28:44+00:00","cve":"CVE-2008-6886","urls":{"html":"https://cve.report/CVE-2008-6886","api":"https://cve.report/api/cve/CVE-2008-6886.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-6886","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-6886"},"summary":{"title":"CVE-2008-6886","description":"RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-08-03 14:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://marc.info/?l=bugtraq&m=122765140110581&w=2","name":"http://marc.info/?l=bugtraq&m=122765140110581&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"'RSA EnVision Remote Password Disclosure' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/3288","name":"http://www.vupen.com/english/advisories/2008/3288","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/32473","name":"http://www.securityfocus.com/bid/32473","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"RSA enVision Platform Web Console Password Hash Remote Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/50273","name":"http://www.osvdb.org/50273","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.secfault.org/?p=78","name":"http://www.secfault.org/?p=78","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SecFault.Org » RSA  Envision Remote Password Disclosure","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46884","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46884","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32883","name":"http://secunia.com/advisories/32883","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"RSA EnVision Password Hash Disclosure Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-6886","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6886","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"6886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rsa","cpe5":"envision","cpe6":"3.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rsa","cpe5":"envision","cpe6":"3.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rsa","cpe5":"envision","cpe6":"3.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rsa","cpe5":"envision","cpe6":"3.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:49:01.820Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20081125 RSA EnVision Remote Password Disclosure","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=122765140110581&w=2"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.secfault.org/?p=78"},{"name":"50273","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/50273"},{"name":"32473","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/32473"},{"name":"32883","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32883"},{"name":"envision-webconsole-info-disclosure(46884)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46884"},{"name":"ADV-2008-3288","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/3288"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-11-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20081125 RSA EnVision Remote Password Disclosure","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=122765140110581&w=2"},{"tags":["x_refsource_MISC"],"url":"http://www.secfault.org/?p=78"},{"name":"50273","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/50273"},{"name":"32473","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/32473"},{"name":"32883","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32883"},{"name":"envision-webconsole-info-disclosure(46884)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46884"},{"name":"ADV-2008-3288","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/3288"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-6886","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20081125 RSA EnVision Remote Password Disclosure","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=122765140110581&w=2"},{"name":"http://www.secfault.org/?p=78","refsource":"MISC","url":"http://www.secfault.org/?p=78"},{"name":"50273","refsource":"OSVDB","url":"http://www.osvdb.org/50273"},{"name":"32473","refsource":"BID","url":"http://www.securityfocus.com/bid/32473"},{"name":"32883","refsource":"SECUNIA","url":"http://secunia.com/advisories/32883"},{"name":"envision-webconsole-info-disclosure(46884)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46884"},{"name":"ADV-2008-3288","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/3288"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-6886","datePublished":"2009-08-03T14:00:00.000Z","dateReserved":"2009-08-03T00:00:00.000Z","dateUpdated":"2024-08-07T11:49:01.820Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-08-03 14:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rsa:envision:3.5.0:*:*:*:*:*:*:*","matchCriteriaId":"3D09DC51-1615-471B-867D-737142885FBC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rsa:envision:3.5.1:*:*:*:*:*:*:*","matchCriteriaId":"EAFAE772-8245-4AC5-AF5B-1E4F0E19661D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rsa:envision:3.5.2:*:*:*:*:*:*:*","matchCriteriaId":"195FFEF0-BF85-427E-AB63-BEE858F36B17"},{"vulnerable":true,"criteria":"cpe:2.3:a:rsa:envision:3.7.0:*:*:*:*:*:*:*","matchCriteriaId":"00A2B824-4429-41A6-A9EE-32A1E6D7C9CA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"6886","Ordinal":"1","Title":"CVE-2008-6886","CVE":"CVE-2008-6886","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"6886","Ordinal":"1","NoteData":"RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.","Type":"Description","Title":"CVE-2008-6886"},{"CveYear":"2008","CveId":"6886","Ordinal":"2","NoteData":"2009-08-03","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"6886","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}