PT-2019-15525 · Rsa+1 · Rsa Identity Governance/Lifecycle+2

Publicado 2019-12-18 · Atualizado 2020-10-22 · CVE-2019-18572

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03 RSA Via Lifecycle and Governance versions prior to 7.1.1 P03

Description The issue concerns an Improper Authentication vulnerability. A Java JMX agent is configured with plain text password authentication, allowing an unauthenticated remote attacker to connect and monitor and manage the Java application.

Recommendations For RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later. For RSA Via Lifecycle and Governance versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later.

Correção

Missing Authentication

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-306

CWE-522

Identificadores relacionados

CVE-2019-18572

Produtos afetados

Java

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-18572 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18572 · Nota de Segurança
• https://community.rsa.com/docs/DOC-109310 · Aviso do Fabricante