CVE-2019-18573 (GCVE-0-2019-18573)

Vulnerability from cvelistv5 – Published: 2019-12-18 20:50 – Updated: 2024-09-16 16:28
VLAI?
Summary
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim’s session and perform arbitrary actions with privileges of the user within the compromised session.
Severity ?
8.7 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE
  • CWE-598 - Information Exposure Through Query Strings in GET Request
Assigner
References
Impacted products
Vendor Product Version
Dell RSA Identity Governance & Lifecycle Affected: unspecified , < 7.1.0 P09, 7.1.1 P03 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:54:14.362Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.rsa.com/docs/DOC-109310"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RSA Identity Governance \u0026 Lifecycle",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "7.1.0 P09, 7.1.1 P03",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-11-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Information Exposure Through Query Strings in GET Request",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-31T15:12:36",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.rsa.com/docs/DOC-109310"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2019-11-26",
          "ID": "CVE-2019-18573",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RSA Identity Governance \u0026 Lifecycle",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "7.1.0 P09, 7.1.1 P03"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 8.7,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-598: Information Exposure Through Query Strings in GET Request"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.rsa.com/docs/DOC-109310",
              "refsource": "MISC",
              "url": "https://community.rsa.com/docs/DOC-109310"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2019-18573",
    "datePublished": "2019-12-18T20:50:14.868223Z",
    "dateReserved": "2019-10-29T00:00:00",
    "dateUpdated": "2024-09-16T16:28:49.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54F243EB-5F06-4728-8815-93BDB5502F74\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD518D4A-157A-42D8-B958-8C4661CE6224\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2715882-4E9F-4E4C-A648-30B5D8B36C63\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"BC3F7997-46CC-4345-981A-4CA38A73BA8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD36DED8-5591-4A76-AD40-7DAED6EF1954\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CF203FD-8A59-4237-820A-FDBE4F28E4B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*\", \"matchCriteriaId\": \"08FC40D4-433A-4EDE-87B1-422D0473D6D8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CF1C39E-D12B-44E4-8172-CD91F17E871B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*\", \"matchCriteriaId\": \"31DCF79D-E1EA-4F65-B355-C821B0D78E73\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*\", \"matchCriteriaId\": \"82CFC850-4C98-42B5-AE77-592FD64E78E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*\", \"matchCriteriaId\": \"9DE35E51-0C69-41A8-9332-A9E411CE0B92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8989E78-229D-47B1-A60F-50394D8DF244\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E9E1900-FE59-440A-87D6-35DE7233EAB3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*\", \"matchCriteriaId\": \"15371ECD-CACD-4E1F-854B-D5EA6D1BBC54\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACD868A6-05CC-4BCF-BC53-EA4418DE5F45\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\\u2019s session and perform arbitrary actions with privileges of the user within the compromised session.\"}, {\"lang\": \"es\", \"value\": \"Los productos RSA Identity Governance and Lifecycle y RSA Via Lifecycle and Governance anteriores a 7.1.1 P03 contienen una vulnerabilidad de fijaci\\u00f3n de sesi\\u00f3n. Un usuario local malintencionado autenticado podr\\u00eda aprovechar esta vulnerabilidad ya que el token de sesi\\u00f3n se expone como parte de la URL. Un atacante remoto puede obtener acceso a la sesi\\u00f3n de la v\\u00edctima y realizar acciones arbitrarias con privilegios del usuario dentro de la sesi\\u00f3n comprometida.\"}]",
      "id": "CVE-2019-18573",
      "lastModified": "2024-11-21T04:33:19.420",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"security_alert@emc.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 5.8}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2019-12-18T21:15:13.083",
      "references": "[{\"url\": \"https://community.rsa.com/docs/DOC-109310\", \"source\": \"security_alert@emc.com\"}, {\"url\": \"https://community.rsa.com/docs/DOC-109310\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security_alert@emc.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security_alert@emc.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-598\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-384\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-18573\",\"sourceIdentifier\":\"security_alert@emc.com\",\"published\":\"2019-12-18T21:15:13.083\",\"lastModified\":\"2024-11-21T04:33:19.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim\u2019s session and perform arbitrary actions with privileges of the user within the compromised session.\"},{\"lang\":\"es\",\"value\":\"Los productos RSA Identity Governance and Lifecycle y RSA Via Lifecycle and Governance anteriores a 7.1.1 P03 contienen una vulnerabilidad de fijaci\u00f3n de sesi\u00f3n. Un usuario local malintencionado autenticado podr\u00eda aprovechar esta vulnerabilidad ya que el token de sesi\u00f3n se expone como parte de la URL. Un atacante remoto puede obtener acceso a la sesi\u00f3n de la v\u00edctima y realizar acciones arbitrarias con privilegios del usuario dentro de la sesi\u00f3n comprometida.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":5.8}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-598\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-384\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54F243EB-5F06-4728-8815-93BDB5502F74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD518D4A-157A-42D8-B958-8C4661CE6224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2715882-4E9F-4E4C-A648-30B5D8B36C63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC3F7997-46CC-4345-981A-4CA38A73BA8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD36DED8-5591-4A76-AD40-7DAED6EF1954\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CF203FD-8A59-4237-820A-FDBE4F28E4B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*\",\"matchCriteriaId\":\"08FC40D4-433A-4EDE-87B1-422D0473D6D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CF1C39E-D12B-44E4-8172-CD91F17E871B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*\",\"matchCriteriaId\":\"31DCF79D-E1EA-4F65-B355-C821B0D78E73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*\",\"matchCriteriaId\":\"82CFC850-4C98-42B5-AE77-592FD64E78E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DE35E51-0C69-41A8-9332-A9E411CE0B92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8989E78-229D-47B1-A60F-50394D8DF244\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E9E1900-FE59-440A-87D6-35DE7233EAB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*\",\"matchCriteriaId\":\"15371ECD-CACD-4E1F-854B-D5EA6D1BBC54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACD868A6-05CC-4BCF-BC53-EA4418DE5F45\"}]}]}],\"references\":[{\"url\":\"https://community.rsa.com/docs/DOC-109310\",\"source\":\"security_alert@emc.com\"},{\"url\":\"https://community.rsa.com/docs/DOC-109310\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.