PT-2019-15524 · Rsa · Rsa Identity Governance/Lifecycle+1

Published 2019-12-18 · Updated 2020-08-31 · CVE-2019-18571

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03 RSA Via Lifecycle and Governance versions prior to 7.1.1 P03

Description The issue concerns a reflected cross-site scripting vulnerability in the My Access Live module. An authenticated malicious user could exploit this by sending a crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.

Recommendations For RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later. For RSA Via Lifecycle and Governance versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-18571

Affected Products

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-18571 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18571 · Vendor Advisory
• https://community.rsa.com/docs/DOC-109310 · Note