PT-2019-16698 · Rsa · Rsa Identity Governance/Lifecycle+1

Published 2019-09-11 · Updated 2020-08-31 · CVE-2019-3760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08 RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08

Description The issue concerns a SQL Injection vulnerability in Workflow Architect, which could be exploited by a remote authenticated malicious user. This user could execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application.

Recommendations For RSA Identity Governance and Lifecycle software versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later. For RSA Via Lifecycle and Governance products versions prior to 7.1.0 P08, update to version 7.1.0 P08 or later.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-20

CWE-89

Related Identifiers

CVE-2019-3760

Affected Products

Rsa Identity Governance/Lifecycle

Rsa Via Lifecycle/Governance

References · 3

• https://osv.dev/vulnerability/CVE-2019-3760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3760 · Security Note
• https://community.rsa.com/docs/DOC-106943 · Note