CVE-2018-1245

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.52%

Published

Jul 13, 2018

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.

Weaknesses (CWE)

CWE-863

Affected Products (3)

emc · rsa_identity_governance_and_lifecyclevulnerable

References (4)

http://seclists.org/fulldisclosure/2018/Jul/46

Mailing ListThird Party Advisory

http://www.securitytracker.com/id/1041287

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Jul/46

Mailing ListThird Party Advisory

http://www.securitytracker.com/id/1041287

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs