Dell EMC RSA Identity Governance up to 7.1.0 P07 Access Request Stored cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in Dell EMC RSA Identity Governance, Lifecycle, RSA Via Lifecycle and Governance up to 7.1.0 P07. This affects an unknown part of the component Access Request Module. Performing a manipulation results in cross site scripting (Stored). This vulnerability was named CVE-2019-3761. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Dell EMC RSA Identity Governance, Lifecycle, RSA Via Lifecycle and Governance up to 7.1.0 P07. It has been classified as problematic. This affects some unknown processing of the component Access Request Module. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application.

The weakness was presented 09/11/2019 (Website). The advisory is shared at dell.com. This vulnerability is uniquely identified as CVE-2019-3761 since 01/03/2019. It is possible to initiate the attack remotely. Required for exploitation is a authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Applying the patch 7.1.0 P08 is able to eliminate this problem.

See VDB-141691, VDB-141692 and VDB-141694 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Dell EMC

Name

• Governance
• Lifecycle
• RSA Identity Governance
• RSA Via Lifecycle

Version

• 7.1.0 P07

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion