cnvd - cnvd-2020-03162

CNVD-2020-03162

Vulnerability from cnvd - Published: 2020-01-22

Title

Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance访问控制错误漏洞

Description

Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance都是美国戴尔（Dell）公司的一套身份验证和生命周期管理解决方案。 Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance 7.1.1 P03之前版本中存在访问控制错误漏洞。该漏洞源于网络系统或产品未正确限制来自未授权角色的资源访问。远程攻击者可利用该漏洞连接到JMX代理并监视和管理Java应用程序。

Severity

高

Patch Name

Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance访问控制错误漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.dell.com/support/security/zh-cn/details/DOC-109310/DSA-2019-164-RSA-Identity-Governance-and-Lifecycle-Product-Security-Update-for-Multiple-Vulnerabi

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-18572

Impacted products

Name
['Dell EMC RSA Identity Governance and Lifecycle <7.1.1 P03', 'Dell RSA Via Lifecycle and Governance <7.1.1 P03']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-18572"
    }
  },
  "description": "Dell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance\u90fd\u662f\u7f8e\u56fd\u6234\u5c14\uff08Dell\uff09\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u9a8c\u8bc1\u548c\u751f\u547d\u5468\u671f\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\n\nDell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance 7.1.1 P03\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u9650\u5236\u6765\u81ea\u672a\u6388\u6743\u89d2\u8272\u7684\u8d44\u6e90\u8bbf\u95ee\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fde\u63a5\u5230JMX\u4ee3\u7406\u5e76\u76d1\u89c6\u548c\u7ba1\u7406Java\u5e94\u7528\u7a0b\u5e8f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.dell.com/support/security/zh-cn/details/DOC-109310/DSA-2019-164-RSA-Identity-Governance-and-Lifecycle-Product-Security-Update-for-Multiple-Vulnerabi",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-03162",
  "openTime": "2020-01-22",
  "patchDescription": "Dell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance\u90fd\u662f\u7f8e\u56fd\u6234\u5c14\uff08Dell\uff09\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u9a8c\u8bc1\u548c\u751f\u547d\u5468\u671f\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nDell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance 7.1.1 P03\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u9650\u5236\u6765\u81ea\u672a\u6388\u6743\u89d2\u8272\u7684\u8d44\u6e90\u8bbf\u95ee\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fde\u63a5\u5230JMX\u4ee3\u7406\u5e76\u76d1\u89c6\u548c\u7ba1\u7406Java\u5e94\u7528\u7a0b\u5e8f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Dell EMC RSA Identity Governance and Lifecycle \u003c7.1.1 P03",
      "Dell RSA Via Lifecycle and Governance \u003c7.1.1 P03"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-18572",
  "serverity": "\u9ad8",
  "submitTime": "2019-12-19",
  "title": "Dell RSA Identity Governance and Lifecycle\u548cRSA Via Lifecycle and Governance\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2019-18572 (GCVE-0-2019-18572)

Vulnerability from cvelistv5 – Published: 2019-12-18 20:50 – Updated: 2024-09-16 22:19

Summary

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application.

Severity ?

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

dell

References

URL

Tags

https://community.rsa.com/docs/DOC-109310

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Dell	RSA Identity Governance & Lifecycle	Affected: unspecified , < 7.1.0 P09, 7.1.1 P03 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:54:14.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.rsa.com/docs/DOC-109310"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RSA Identity Governance \u0026 Lifecycle",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "7.1.0 P09, 7.1.1 P03",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-11-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-31T15:12:36",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.rsa.com/docs/DOC-109310"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2019-11-26",
          "ID": "CVE-2019-18572",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RSA Identity Governance \u0026 Lifecycle",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "7.1.0 P09, 7.1.1 P03"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 8.3,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-306: Missing Authentication for Critical Function"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.rsa.com/docs/DOC-109310",
              "refsource": "MISC",
              "url": "https://community.rsa.com/docs/DOC-109310"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2019-18572",
    "datePublished": "2019-12-18T20:50:14.414861Z",
    "dateReserved": "2019-10-29T00:00:00",
    "dateUpdated": "2024-09-16T22:19:43.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-03162

CVE-2019-18572 (GCVE-0-2019-18572)

Tags

Sightings

Nomenclature