Lucene search

DellCVE-2019-3763

HistorySep 11, 2019 - 8:15 p.m.

CVE-2019-3763

2019-09-1120:15:11

CWE-532

dell

web.nvd.nist.gov

rsa

identity governance

lifecycle software

via lifecycle

governance

vulnerability

information exposure

office 365

password

plaintext

debug log

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

Percentile

5.1%

JSON

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Office 365 connector debug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use in further attacks.

Affected configurations

Nvd

Vulners

Node

dellrsa_identity_governance_and_lifecycleMatch7.0.1-

dellrsa_identity_governance_and_lifecycleMatch7.0.1p1

dellrsa_identity_governance_and_lifecycleMatch7.0.1p2_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.1p3

dellrsa_identity_governance_and_lifecycleMatch7.0.1p4

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5

dellrsa_identity_governance_and_lifecycleMatch7.0.1p5_hotfix2

dellrsa_identity_governance_and_lifecycleMatch7.0.2-

dellrsa_identity_governance_and_lifecycleMatch7.0.2p1

dellrsa_identity_governance_and_lifecycleMatch7.0.2p10

dellrsa_identity_governance_and_lifecycleMatch7.0.2p11

dellrsa_identity_governance_and_lifecycleMatch7.0.2p12

dellrsa_identity_governance_and_lifecycleMatch7.0.2p13

dellrsa_identity_governance_and_lifecycleMatch7.0.2p14

dellrsa_identity_governance_and_lifecycleMatch7.0.2p2

dellrsa_identity_governance_and_lifecycleMatch7.0.2p3

dellrsa_identity_governance_and_lifecycleMatch7.0.2p4

dellrsa_identity_governance_and_lifecycleMatch7.0.2p5

dellrsa_identity_governance_and_lifecycleMatch7.0.2p6

dellrsa_identity_governance_and_lifecycleMatch7.0.2p7

dellrsa_identity_governance_and_lifecycleMatch7.0.2p8

dellrsa_identity_governance_and_lifecycleMatch7.0.2p9

dellrsa_identity_governance_and_lifecycleMatch7.1.0-

dellrsa_identity_governance_and_lifecycleMatch7.1.0p01

dellrsa_identity_governance_and_lifecycleMatch7.1.0p02

dellrsa_identity_governance_and_lifecycleMatch7.1.0p03

dellrsa_identity_governance_and_lifecycleMatch7.1.0p04

dellrsa_identity_governance_and_lifecycleMatch7.1.0p05

dellrsa_identity_governance_and_lifecycleMatch7.1.0p06

dellrsa_identity_governance_and_lifecycleMatch7.1.0p07

dellrsa_identity_governance_and_lifecycleMatch7.1.1-

dellrsa_identity_governance_and_lifecycleMatch7.1.1p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0-

dellrsa_via_lifecycle_and_governanceMatch7.0.0p1

dellrsa_via_lifecycle_and_governanceMatch7.0.0p2

dellrsa_via_lifecycle_and_governanceMatch7.0.0p3

dellrsa_via_lifecycle_and_governanceMatch7.0.0p4

dellrsa_via_lifecycle_and_governanceMatch7.0.0p5

VendorProductVersionCPE
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5::::::
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1::::::
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10::::::

Rows per page:

1-10 of 381

CNA Affected

[
  {
    "product": "RSA Identity Governance and Lifecycle",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "7.1.1 P02",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "7.1.0 P08",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.2"
      },
      {
        "status": "affected",
        "version": "7.0.1"
      }
    ]
  },
  {
    "product": "RSA Via Lifecycle and Governance",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "7.0"
      }
    ]
  }
]

References

community.rsa.com/docs/DOC-106943

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-3763