Lucene search

[email protected]CVE-2018-14597

HistoryOct 17, 2018 - 9:49 p.m.

CVE-2018-14597

2018-10-1721:49:52

CWE-200

CWE-203

[email protected]

web.nvd.nist.gov

cve-2018-14597

ca technologies

identity governance

identity suite

virtual appliance

security vulnerability

remote attackers

account enumeration

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.2%

JSON

CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.

Affected configurations

NVD

Node

broadcomca_identity_governanceRange14.0–14.2

broadcomca_identity_governanceMatch12.6

broadcomca_identity_suite_virtual_applianceRange14.0–14.2

CPENameOperatorVersion
broadcom:ca_identity_governancebroadcom ca identity governancele14.2
broadcom:ca_identity_governancebroadcom ca identity governanceeq12.6
broadcom:ca_identity_suite_virtual_appliancebroadcom ca identity suite virtual appliancele14.2

CPE	Name	Operator	Version
broadcom:ca_identity_governance	broadcom ca identity governance	le	14.2
broadcom:ca_identity_governance	broadcom ca identity governance	eq	12.6
broadcom:ca_identity_suite_virtual_appliance	broadcom ca identity suite virtual appliance	le	14.2

CNA Affected

[
  {
    "product": "CA Identity Governance",
    "vendor": "CA Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "14.x"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105688

support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.2%

JSON

Related for CVE-2018-14597

prion1 cvelist1 nvd1