CVE-2011-2740
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedEMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceEMC RSA Key Manager Appliance versions 2.7 SP1 before 2.7.1.6 fail to properly terminate user sessions upon logout when the client uses Firefox 4.x or 5.0. This session termination flaw leaves active sessions accessible on unattended workstations, enabling remote attackers with physical access to execute arbitrary code through the lingering authenticated session.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 2.7CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- M
- Authentication
- None
- Confidentiality
- Complete
- Integrity
- Complete
- Availability
- Complete
AV:N/AC:M/Au:N/C:C/I:C/A:C
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify RSA Key Manager Appliance versionAccess the appliance admin console or check the product documentation/versioning system to confirm the installed version is 2.7 (specifically 2.7 SP1)Affected if The appliance version is 2.7 SP1 and is earlier than 2.7.1.6
-
Identify client browser in useCheck the browser version on workstations accessing the RKM Appliance. This can be done by opening Firefox, navigating to Help > About Firefox, or entering 'about:support' in the address barAffected if The client browser is Firefox version 4.x or 5.0
-
Verify session termination behaviorLog in to the RKM Appliance from Firefox 4.x or 5.0, perform legitimate operations, click logout, then attempt to access the appliance URL or cached session data from the same browser window without re-authenticatingAffected if After clicking logout, the session remains active and does not require re-authentication, indicating the session termination flaw is present
A user is affected if they are running RSA Key Manager Appliance version 2.7 SP1 (before 2.7.1.6) and clients access the appliance using Firefox 4.x or 5.0, causing sessions to remain active after logout.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade RKM Appliance to version 2.7.1.6 or later, which contains the proper session termination fix. Until patched, enforce strict workstation policies requiring explicit session locking or physical security to prevent unauthorized access to active sessions.
2.7.1.6
- Identify current RSA Key Manager Appliance version by accessing the appliance admin console or checking system information
- Download RSA Key Manager Appliance version 2.7.1.6 or later from EMC RSA's official support portal
- Follow EMC's documented upgrade procedure for RKM Appliance, which typically involves: a) Backing up the current configuration, b) Stopping RKM services, c) Running the upgrade installer, d) Verifying the upgrade completed successfully
- After upgrade, verify the fix by testing logout functionality with Firefox 4.x or 5.0 to confirm session is properly terminated
- Ensure all admin workstations are updated to supported browser versions if needed
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2011-2740 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2011-2740 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data