PT-2019-16697 · Rsa · Rsa Identity Governance/Lifecycle+1

Publicado 2019-09-11 · Atualizado 2020-08-31 · CVE-2019-3759

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08 RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08

Description The issue allows a remote authenticated malicious user to potentially exploit a code injection vulnerability, enabling them to run custom Groovy scripts. This could result in limited access to view or modify information on the Workflow system.

Recommendations For RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later. For RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-3759

Produtos afetados

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

Referências · 5

• 🔥 https://exploit-db.com/exploits/48639 · Exploit
• https://osv.dev/vulnerability/CVE-2019-3759 · Aviso do Fabricante
• http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html · Nota
• https://community.rsa.com/docs/DOC-106943 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3759 · Nota de Segurança