Vulnerability CVE-2018-11049


Published: 2018-07-11

Description:
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.

Type:

CWE-427

(Uncontrolled Search Path Element)

CVSS2 => (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.9/10
10/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
EMC -> Rsa identity governance and lifecycle 
EMC -> Rsa identity management and governance 
EMC -> Rsa via lifecycle and governance 

 References:
http://seclists.org/fulldisclosure/2018/Jul/23
http://www.securityfocus.com/bid/104722
http://www.securitytracker.com/id/1041228

Copyright 2024, cxsecurity.com

 

Back to Top