Dell EMC RSA Identity Lifecycle/Governance 7.0.1/7.0.2/7.1.0 Web Application Reflected cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in Dell EMC RSA Identity Lifecycle and Governance 7.0.1/7.0.2/7.1.0. Affected by this issue is some unknown functionality of the component Web Application. Executing a manipulation can lead to cross site scripting (Reflected). This vulnerability appears as CVE-2018-1255. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Dell EMC RSA Identity Lifecycle and Governance 7.0.1/7.0.2/7.1.0. It has been declared as problematic. This vulnerability affects an unknown function of the component Web Application. The manipulation with an unknown input leads to a cross site scripting vulnerability (Reflected). The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.

The bug was discovered 07/11/2018. The weakness was presented 07/13/2018 as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. This vulnerability was named CVE-2018-1255 since 12/06/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/09/2023). The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-121407 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Dell EMC

Name

• Governance
• RSA Identity Lifecycle

Version

• 7.0.1
• 7.0.2
• 7.1.0

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion