{"containers": {"cna": {"affected": [{"product": "RSA Identity Governance & Lifecycle", "vendor": "Dell", "versions": [{"lessThan": "7.1.0 P09, 7.1.1 P03", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-11-26T00:00:00", "descriptions": [{"lang": "en", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-31T15:12:36", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.rsa.com/docs/DOC-109310"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2019-11-26", "ID": "CVE-2019-18572", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "RSA Identity Governance & Lifecycle", "version": {"version_data": [{"version_affected": "<", "version_value": "7.1.0 P09, 7.1.1 P03"}]}}]}, "vendor_name": "Dell"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application."}]}, "impact": {"cvss": {"baseScore": 8.3, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-306: Missing Authentication for Critical Function"}]}]}, "references": {"reference_data": [{"name": "https://community.rsa.com/docs/DOC-109310", "refsource": "MISC", "url": "https://community.rsa.com/docs/DOC-109310"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-18572", "datePublished": "2019-11-26T00:00:00", "dateReserved": "2019-10-29T00:00:00", "dateUpdated": "2020-08-31T15:12:36", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "54F243EB-5F06-4728-8815-93BDB5502F74", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DD518D4A-157A-42D8-B958-8C4661CE6224", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "E2715882-4E9F-4E4C-A648-30B5D8B36C63", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "BC3F7997-46CC-4345-981A-4CA38A73BA8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*", "matchCriteriaId": "DD36DED8-5591-4A76-AD40-7DAED6EF1954", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*", "matchCriteriaId": "6CF203FD-8A59-4237-820A-FDBE4F28E4B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*", "matchCriteriaId": "08FC40D4-433A-4EDE-87B1-422D0473D6D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*", "matchCriteriaId": "5CF1C39E-D12B-44E4-8172-CD91F17E871B", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*", "matchCriteriaId": "31DCF79D-E1EA-4F65-B355-C821B0D78E73", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*", "matchCriteriaId": "82CFC850-4C98-42B5-AE77-592FD64E78E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*", "matchCriteriaId": "9DE35E51-0C69-41A8-9332-A9E411CE0B92", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*", "matchCriteriaId": "A8989E78-229D-47B1-A60F-50394D8DF244", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*", "matchCriteriaId": "6E9E1900-FE59-440A-87D6-35DE7233EAB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*", "matchCriteriaId": "15371ECD-CACD-4E1F-854B-D5EA6D1BBC54", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*", "matchCriteriaId": "ACD868A6-05CC-4BCF-BC53-EA4418DE5F45", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application."}, {"lang": "es", "value": "Los productos RSA Identity Governance and Lifecycle y RSA Via Lifecycle and Governance versiones anteriores a 7.1.1 P03, contienen una vulnerabilidad de Autenticaci\u00f3n Inapropiada. Un agente Java JMX que se ejecuta en el host remoto est\u00e1 configurado con autenticaci\u00f3n de contrase\u00f1a de texto plano. Un atacante remoto no autenticado puede conectarse al agente JMX y monitorear y administrar la aplicaci\u00f3n Java."}], "id": "CVE-2019-18572", "lastModified": "2020-10-22T17:25:59.047", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security_alert@emc.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-18T21:15:12.943", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://community.rsa.com/docs/DOC-109310"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}