PT-2019-16700 · Rsa+1 · Rsa Identity Governance/Lifecycle+2

Publicado 2019-09-11 · Atualizado 2020-10-16 · CVE-2019-3763

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08 RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08

Description The issue allows an authenticated malicious local user with access to the debug logs to obtain an exposed password. This occurs because the Office 365 user password may get logged in plain text format in the Office 365 connector debug log file.

Recommendations For RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later. For RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later. As a temporary workaround, consider restricting access to the Office 365 connector debug log file to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-3763

Produtos afetados

Office 365

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-3763 · Aviso do Fabricante
• https://community.rsa.com/docs/DOC-106943 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3763 · Nota de Segurança