PT-2019-15525 · Rsa+1 · Rsa Identity Governance/Lifecycle+2

Published 2019-12-18 · Updated 2020-10-22 · CVE-2019-18572

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03 RSA Via Lifecycle and Governance versions prior to 7.1.1 P03

Description The issue concerns an Improper Authentication vulnerability. A Java JMX agent is configured with plain text password authentication, allowing an unauthenticated remote attacker to connect and monitor and manage the Java application.

Recommendations For RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later. For RSA Via Lifecycle and Governance versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later.

Fix

Missing Authentication

Insufficiently Protected Credentials

Weakness Enumeration

CWE-306

CWE-522

Related Identifiers

CVE-2019-18572

Affected Products

Java

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

References · 3

• https://osv.dev/vulnerability/CVE-2019-18572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18572 · Security Note
• https://community.rsa.com/docs/DOC-109310 · Vendor Advisory