Lucene search

[email protected]CVE-2017-5003

HistoryJun 09, 2017 - 9:29 p.m.

CVE-2017-5003

2017-06-0921:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2017-5003

emc

rsa

identity governance

lifecycle

xss

vulnerabilities

nvd

security advisory

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Reflected Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.

Affected configurations

NVD

Node

emcrsa_identity_governance_and_lifecycleMatch7.0.1

emcrsa_identity_governance_and_lifecycleMatch7.0.2

emcrsa_identity_management_and_governanceMatch6.9.1

rsarsa_via_lifecycle_and_governanceMatch7.0

CPENameOperatorVersion
emc:rsa_identity_governance_and_lifecycleemc rsa identity governance and lifecycleeq7.0.1
emc:rsa_identity_governance_and_lifecycleemc rsa identity governance and lifecycleeq7.0.2
emc:rsa_identity_management_and_governanceemc rsa identity management and governanceeq6.9.1
rsa:rsa_via_lifecycle_and_governancersa rsa via lifecycle and governanceeq7.0

CPE	Name	Operator	Version
emc:rsa_identity_governance_and_lifecycle	emc rsa identity governance and lifecycle	eq	7.0.1
emc:rsa_identity_governance_and_lifecycle	emc rsa identity governance and lifecycle	eq	7.0.2
emc:rsa_identity_management_and_governance	emc rsa identity management and governance	eq	6.9.1
rsa:rsa_via_lifecycle_and_governance	rsa rsa via lifecycle and governance	eq	7.0

CNA Affected

[
  {
    "product": "RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels, RSA Via Lifecycle and Governance version 7.0, all patch levels, RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels, RSA Via Lifecycle and Governance version 7.0, all patch levels, RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels"
      }
    ]
  }
]

References

www.securityfocus.com/archive/1/540693/30/0/threaded

www.securityfocus.com/bid/98974

www.securitytracker.com/id/1038648

web.archive.org/web/20210116013250/www.securityfocus.com/archive/1/540693/30/0/threaded

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

Related for CVE-2017-5003

prion1 cvelist1 nvd1