PT-2018-10833 · Rsa+1 · Rsa Identity Management/Governance+2

Published 2018-03-08 · Updated 2021-08-06 · CVE-2018-1182

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Governance and Lifecycle versions 7.0.1 through 7.0.2 RSA Via Lifecycle and Governance version 7.0 RSA Identity Management & Governance (RSA IMG) versions 6.9.0 through 6.9.1

Description An issue allows certain OS level users to execute arbitrary scripts with root level privileges.

Recommendations For EMC RSA Identity Governance and Lifecycle versions 7.0.1 and 7.0.2, restrict access to root level privileges to minimize the risk of exploitation. For RSA Via Lifecycle and Governance version 7.0, consider disabling script execution for non-privileged OS level users until a fix is available. For RSA Identity Management & Governance (RSA IMG) versions 6.9.0 and 6.9.1, limit the execution of arbitrary scripts to prevent potential attacks.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-1182

Affected Products

Rsa Identity Governance/Lifecycle

Rsa Identity Management/Governance

Rsa Via Lifecycle/Governance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1182 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1182 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Mar/16 · Note
• http://securitytracker.com/id/1040458 · Note
• http://securityfocus.com/bid/103317 · Note