SB2019091158 - Multiple vulnerabilities in RSA Identity Governance and Lifecycle

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2019-3759)

The vulnerability allows a remote authenticated user to read and manipulate data.

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.

2) SQL injection (CVE-ID: CVE-2019-3760)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

3) Cross-site scripting (CVE-ID: CVE-2019-3761)

The vulnerability allows a remote authenticated user to read and manipulate data.

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application.

4) Information disclosure (CVE-ID: CVE-2019-3763)

The vulnerability allows a local authenticated user to execute arbitrary code.

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Office 365 connector debug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use in further attacks.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html
• https://www.dell.com/support/security/en-us/details/DOC-106943/DSA-2019-134-RSA-Identity-Governance-and-Lifecycle-Product-Security-Update-for-Multiple-Vulnerabi