{"containers": {"cna": {"affected": [{"product": "RSA Identity Governance & Lifecycle", "vendor": "Dell", "versions": [{"lessThan": "7.1.0 P09, 7.1.1 P03", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-11-26T00:00:00", "descriptions": [{"lang": "en", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-598", "description": "CWE-598: Information Exposure Through Query Strings in GET Request", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-31T15:12:36", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.rsa.com/docs/DOC-109310"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2019-11-26", "ID": "CVE-2019-18573", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "RSA Identity Governance & Lifecycle", "version": {"version_data": [{"version_affected": "<", "version_value": "7.1.0 P09, 7.1.1 P03"}]}}]}, "vendor_name": "Dell"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session."}]}, "impact": {"cvss": {"baseScore": 8.7, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-598: Information Exposure Through Query Strings in GET Request"}]}]}, "references": {"reference_data": [{"name": "https://community.rsa.com/docs/DOC-109310", "refsource": "MISC", "url": "https://community.rsa.com/docs/DOC-109310"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-18573", "datePublished": "2019-11-26T00:00:00", "dateReserved": "2019-10-29T00:00:00", "dateUpdated": "2020-08-31T15:12:36", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "54F243EB-5F06-4728-8815-93BDB5502F74", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DD518D4A-157A-42D8-B958-8C4661CE6224", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "E2715882-4E9F-4E4C-A648-30B5D8B36C63", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "BC3F7997-46CC-4345-981A-4CA38A73BA8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*", "matchCriteriaId": "DD36DED8-5591-4A76-AD40-7DAED6EF1954", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*", "matchCriteriaId": "6CF203FD-8A59-4237-820A-FDBE4F28E4B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*", "matchCriteriaId": "08FC40D4-433A-4EDE-87B1-422D0473D6D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*", "matchCriteriaId": "5CF1C39E-D12B-44E4-8172-CD91F17E871B", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*", "matchCriteriaId": "31DCF79D-E1EA-4F65-B355-C821B0D78E73", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*", "matchCriteriaId": "82CFC850-4C98-42B5-AE77-592FD64E78E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*", "matchCriteriaId": "9DE35E51-0C69-41A8-9332-A9E411CE0B92", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*", "matchCriteriaId": "A8989E78-229D-47B1-A60F-50394D8DF244", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*", "matchCriteriaId": "6E9E1900-FE59-440A-87D6-35DE7233EAB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*", "matchCriteriaId": "15371ECD-CACD-4E1F-854B-D5EA6D1BBC54", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*", "matchCriteriaId": "ACD868A6-05CC-4BCF-BC53-EA4418DE5F45", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session."}, {"lang": "es", "value": "Los productos RSA Identity Governance and Lifecycle y RSA Via Lifecycle and Governance anteriores a 7.1.1 P03 contienen una vulnerabilidad de fijaci\u00f3n de sesi\u00f3n. Un usuario local malintencionado autenticado podr\u00eda aprovechar esta vulnerabilidad ya que el token de sesi\u00f3n se expone como parte de la URL. Un atacante remoto puede obtener acceso a la sesi\u00f3n de la v\u00edctima y realizar acciones arbitrarias con privilegios del usuario dentro de la sesi\u00f3n comprometida."}], "id": "CVE-2019-18573", "lastModified": "2020-08-31T16:15:13.053", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security_alert@emc.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-18T21:15:13.083", "references": [{"source": "security_alert@emc.com", "url": "https://community.rsa.com/docs/DOC-109310"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-598"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}