A vulnerability was found in Dell EMC RSA Identity Governance, Lifecycle, RSA Via Lifecycle and Governance up to 7.1.0 P07 and classified as critical. Affected by this issue is an unknown code block of the component Back-End Database. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application.

The weakness was disclosed 09/11/2019 (Website). The advisory is shared for download at dell.com. This vulnerability is handled as CVE-2019-3760 since 01/03/2019. The attack may be launched remotely. The requirement for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Applying the patch 7.1.0 P08 is able to eliminate this problem.

The entries VDB-141691, VDB-141693 and VDB-141694 are pretty similar.

Productinfo

Vendor

• Dell EMC

Name

• Governance
• Lifecycle
• RSA Identity Governance
• RSA Via Lifecycle

Version

• 7.1.0 P07

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion