Dell EMC RSA Identity Lifecycle/Governance 7.0.1/7.0.2/7.1.0 ACM Webserver improper authorization

Summaryinfo

A vulnerability classified as critical has been found in Dell EMC RSA Identity Lifecycle and Governance 7.0.1/7.0.2/7.1.0. Affected by this vulnerability is an unknown functionality of the component ACM Webserver. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2018-1245. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Dell EMC RSA Identity Lifecycle and Governance 7.0.1/7.0.2/7.1.0. It has been classified as critical. This affects some unknown processing of the component ACM Webserver. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.

The bug was discovered 07/11/2018. The weakness was disclosed 07/13/2018 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. This vulnerability is uniquely identified as CVE-2018-1245 since 12/06/2017. It is possible to initiate the attack remotely. Required for exploitation is a authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/09/2023). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-121408 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Dell EMC

Name

• Governance
• RSA Identity Lifecycle

Version

• 7.0.1
• 7.0.2
• 7.1.0

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion