Lucene search

DellCVE-2019-3759

HistorySep 11, 2019 - 8:15 p.m.

CVE-2019-3759

2019-09-1120:15:11

CWE-94

dell

web.nvd.nist.gov

cve-2019-3759

rsa

identity governance

lifecycle

software

code injection

vulnerability

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.006

Percentile

78.5%

JSON

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.

Affected configurations

Nvd

Vulners

Node

dellrsa_identity_governance_and_lifecycleMatch7.0.1-

dellrsa_identity_governance_and_lifecycleMatch7.0.1p1

dellrsa_identity_governance_and_lifecycleMatch7.0.1p2_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.1p3

dellrsa_identity_governance_and_lifecycleMatch7.0.1p4

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.2-

dellrsa_identity_governance_and_lifecycleMatch7.0.2p1

dellrsa_identity_governance_and_lifecycleMatch7.0.2p10

dellrsa_identity_governance_and_lifecycleMatch7.0.2p11

dellrsa_identity_governance_and_lifecycleMatch7.0.2p12

dellrsa_identity_governance_and_lifecycleMatch7.0.2p13

dellrsa_identity_governance_and_lifecycleMatch7.0.2p14

dellrsa_identity_governance_and_lifecycleMatch7.0.2p2

dellrsa_identity_governance_and_lifecycleMatch7.0.2p3

dellrsa_identity_governance_and_lifecycleMatch7.0.2p4

dellrsa_identity_governance_and_lifecycleMatch7.0.2p5

dellrsa_identity_governance_and_lifecycleMatch7.0.2p6

dellrsa_identity_governance_and_lifecycleMatch7.0.2p7

dellrsa_identity_governance_and_lifecycleMatch7.0.2p8

dellrsa_identity_governance_and_lifecycleMatch7.0.2p9

dellrsa_identity_governance_and_lifecycleMatch7.1.0-

dellrsa_identity_governance_and_lifecycleMatch7.1.0p01

dellrsa_identity_governance_and_lifecycleMatch7.1.0p02

dellrsa_identity_governance_and_lifecycleMatch7.1.0p03

dellrsa_identity_governance_and_lifecycleMatch7.1.0p04

dellrsa_identity_governance_and_lifecycleMatch7.1.0p05

dellrsa_identity_governance_and_lifecycleMatch7.1.0p06

dellrsa_identity_governance_and_lifecycleMatch7.1.0p07

dellrsa_identity_governance_and_lifecycleMatch7.1.1-

dellrsa_identity_governance_and_lifecycleMatch7.1.1p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0-

dellrsa_via_lifecycle_and_governanceMatch7.0.0p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0p2

dellrsa_via_lifecycle_and_governanceMatch7.0.0p3

dellrsa_via_lifecycle_and_governanceMatch7.0.0p4

dellrsa_via_lifecycle_and_governanceMatch7.0.0p5

VendorProductVersionCPE
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10::::::

Rows per page:

1-10 of 381

CNA Affected

[
  {
    "product": "RSA Identity Governance and Lifecycle",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "7.1.1 P02",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "7.1.0 P08",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.2"
      },
      {
        "status": "affected",
        "version": "7.0.1"
      }
    ]
  },
  {
    "product": "RSA Via Lifecycle and Governance",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "7.0"
      }
    ]
  }
]

References

packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html

community.rsa.com/docs/DOC-106943

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.006

Percentile

78.5%

JSON

Related for CVE-2019-3759