CVE-2019-3759

Published: Sep 11, 2019Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.

Affected (38)

Products: Dell: Rsa Identity Governance And Lifecycle, Rsa Via Lifecycle And Governance

Dell

2 products

Rsa Identity Governance And Lifecycle

Rsa Via Lifecycle And Governance

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p1
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p2_hotfix2
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p3
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p4
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p5
Dell Rsa Identity Governance And Lifecycle	Version 7.0.1 p5_hotfix2
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p10
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p11
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p12
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p13
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p14
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p1
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p2
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p3
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p4
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p5
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p6
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p7
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p8
Dell Rsa Identity Governance And Lifecycle	Version 7.0.2 p9
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p01
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p02
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p03
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p04
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p05
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p06
Dell Rsa Identity Governance And Lifecycle	Version 7.1.0 p07
Dell Rsa Identity Governance And Lifecycle	Version 7.1.1
Dell Rsa Identity Governance And Lifecycle	Version 7.1.1 p1
Dell Rsa Via Lifecycle And Governance	Version 7.0.0
Dell Rsa Via Lifecycle And Governance	Version 7.0.0 p1
Dell Rsa Via Lifecycle And Governance	Version 7.0.0 p2
Dell Rsa Via Lifecycle And Governance	Version 7.0.0 p3
Dell Rsa Via Lifecycle And Governance	Version 7.0.0 p4
Dell Rsa Via Lifecycle And Governance	Version 7.0.0 p5

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html

Source: security_alert@emc.com

https://community.rsa.com/docs/DOC-106943

Source: security_alert@emc.com

http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://community.rsa.com/docs/DOC-106943

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.