Lucene search

DellCVE-2019-3760

HistorySep 11, 2019 - 8:15 p.m.

CVE-2019-3760

2019-09-1120:15:11

CWE-89

CWE-20

dell

web.nvd.nist.gov

cve-2019-3760

rsa

identity governance

lifecycle

sql injection

vulnerability

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application.

Affected configurations

Nvd

Vulners

Node

dellrsa_identity_governance_and_lifecycleMatch7.0.1-

dellrsa_identity_governance_and_lifecycleMatch7.0.1p1

dellrsa_identity_governance_and_lifecycleMatch7.0.1p2_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.1p3

dellrsa_identity_governance_and_lifecycleMatch7.0.1p4

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.2-

dellrsa_identity_governance_and_lifecycleMatch7.0.2p1

dellrsa_identity_governance_and_lifecycleMatch7.0.2p10

dellrsa_identity_governance_and_lifecycleMatch7.0.2p11

dellrsa_identity_governance_and_lifecycleMatch7.0.2p12

dellrsa_identity_governance_and_lifecycleMatch7.0.2p13

dellrsa_identity_governance_and_lifecycleMatch7.0.2p14

dellrsa_identity_governance_and_lifecycleMatch7.0.2p2

dellrsa_identity_governance_and_lifecycleMatch7.0.2p3

dellrsa_identity_governance_and_lifecycleMatch7.0.2p4

dellrsa_identity_governance_and_lifecycleMatch7.0.2p5

dellrsa_identity_governance_and_lifecycleMatch7.0.2p6

dellrsa_identity_governance_and_lifecycleMatch7.0.2p7

dellrsa_identity_governance_and_lifecycleMatch7.0.2p8

dellrsa_identity_governance_and_lifecycleMatch7.0.2p9

dellrsa_identity_governance_and_lifecycleMatch7.1.0-

dellrsa_identity_governance_and_lifecycleMatch7.1.0p01

dellrsa_identity_governance_and_lifecycleMatch7.1.0p02

dellrsa_identity_governance_and_lifecycleMatch7.1.0p03

dellrsa_identity_governance_and_lifecycleMatch7.1.0p04

dellrsa_identity_governance_and_lifecycleMatch7.1.0p05

dellrsa_identity_governance_and_lifecycleMatch7.1.0p06

dellrsa_identity_governance_and_lifecycleMatch7.1.0p07

dellrsa_identity_governance_and_lifecycleMatch7.1.1-

dellrsa_identity_governance_and_lifecycleMatch7.1.1p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0-

dellrsa_via_lifecycle_and_governanceMatch7.0.0p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0p2

dellrsa_via_lifecycle_and_governanceMatch7.0.0p3

dellrsa_via_lifecycle_and_governanceMatch7.0.0p4

dellrsa_via_lifecycle_and_governanceMatch7.0.0p5

VendorProductVersionCPE
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10::::::

Rows per page:

1-10 of 381

CNA Affected

[
  {
    "product": "RSA Identity Governance and Lifecycle",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "7.1.1 P02",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "7.1.0 P08",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.2"
      },
      {
        "status": "affected",
        "version": "7.0.1"
      }
    ]
  },
  {
    "product": "RSA Via Lifecycle and Governance",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "7.0"
      }
    ]
  }
]

References

community.rsa.com/docs/DOC-106943

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

Related for CVE-2019-3760