PT-2018-10833 · Rsa+1 · Rsa Identity Management/Governance+2

Publicado 2018-03-08 · Atualizado 2021-08-06 · CVE-2018-1182

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Governance and Lifecycle versions 7.0.1 through 7.0.2 RSA Via Lifecycle and Governance version 7.0 RSA Identity Management & Governance (RSA IMG) versions 6.9.0 through 6.9.1

Description An issue allows certain OS level users to execute arbitrary scripts with root level privileges.

Recommendations For EMC RSA Identity Governance and Lifecycle versions 7.0.1 and 7.0.2, restrict access to root level privileges to minimize the risk of exploitation. For RSA Via Lifecycle and Governance version 7.0, consider disabling script execution for non-privileged OS level users until a fix is available. For RSA Identity Management & Governance (RSA IMG) versions 6.9.0 and 6.9.1, limit the execution of arbitrary scripts to prevent potential attacks.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-1182

Produtos afetados

Rsa Identity Governance/Lifecycle

Rsa Identity Management/Governance

Rsa Via Lifecycle/Governance

Referências · 5

• http://seclists.org/fulldisclosure/2018/Mar/16 · Nota
• http://securitytracker.com/id/1040458 · Nota
• http://securityfocus.com/bid/103317 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1182 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1182 · Aviso do Fabricante