PT-2019-15526 · Rsa · Rsa Identity Governance/Lifecycle+1

Published 2019-12-18 · Updated 2020-08-31 · CVE-2019-18573

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03 RSA Via Lifecycle and Governance versions prior to 7.1.1 P03

Description The issue allows an authenticated malicious local user to exploit a Session Fixation vulnerability, as the session token is exposed as part of the URL. A remote attacker can gain access to the victim's session and perform arbitrary actions with the privileges of the user within the compromised session.

Recommendations For RSA Identity Governance and Lifecycle versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later to resolve the issue. For RSA Via Lifecycle and Governance versions prior to 7.1.1 P03, update to version 7.1.1 P03 or later to resolve the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-598

CWE-384

Related Identifiers

CVE-2019-18573

Affected Products

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

References · 3

• https://osv.dev/vulnerability/CVE-2019-18573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18573 · Security Note
• https://community.rsa.com/docs/DOC-109310 · Note