Lucene search

[email protected]NVD:CVE-2019-18572

HistoryDec 18, 2019 - 9:15 p.m.

CVE-2019-18572

2019-12-1821:15:12

CWE-306

CWE-522

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

79.2%

JSON

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application.

Affected configurations

Nvd

Node

dellrsa_identity_governance_and_lifecycleMatch7.0

dellrsa_identity_governance_and_lifecycleMatch7.0.1

dellrsa_identity_governance_and_lifecycleMatch7.0.2

dellrsa_identity_governance_and_lifecycleMatch7.1.0-

dellrsa_identity_governance_and_lifecycleMatch7.1.0p01

dellrsa_identity_governance_and_lifecycleMatch7.1.0p02

dellrsa_identity_governance_and_lifecycleMatch7.1.0p03

dellrsa_identity_governance_and_lifecycleMatch7.1.0p04

dellrsa_identity_governance_and_lifecycleMatch7.1.0p05

dellrsa_identity_governance_and_lifecycleMatch7.1.0p06

dellrsa_identity_governance_and_lifecycleMatch7.1.0p07

dellrsa_identity_governance_and_lifecycleMatch7.1.0p08

dellrsa_identity_governance_and_lifecycleMatch7.1.1-

dellrsa_identity_governance_and_lifecycleMatch7.1.1p01

dellrsa_identity_governance_and_lifecycleMatch7.1.1p02

VendorProductVersionCPE
dellrsa_identity_governance_and_lifecycle7.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.1cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.0.2cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*
dellrsa_identity_governance_and_lifecycle7.1.0cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	rsa_identity_governance_and_lifecycle	7.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:::::::*
dell	rsa_identity_governance_and_lifecycle	7.0.1	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:::::::*
dell	rsa_identity_governance_and_lifecycle	7.0.2	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:::::::*
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05::::::
dell	rsa_identity_governance_and_lifecycle	7.1.0	cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06::::::

Rows per page:

1-10 of 151

References

community.rsa.com/docs/DOC-109310

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

79.2%

JSON

Related for NVD:CVE-2019-18572

prion1 cve1 cvelist1