Command injection in RSA Identity Governance and Lifecycle - CVE-2018-1245
Published: July 13, 2018
Vulnerability identifier: #VU13865
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1245
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.
The weakness exists due to insufficient sanitization of user-supplied data. A remote attacker can bypass Java Security Policies to inject and execute arbitrary system commands on the target system with the privileges of the target application.
Affected software
RSA Identity Governance and Lifecycle
How to mitigate CVE-2018-1245
Update to version 7.0.2 P07, 7.1.0 P01.
RSA Identity Governance and Lifecycle - addressed in versions 7.0.2 P07, 7.1.0 P01