CVE-2019-3759CWE-94

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability

Medium · published September 11, 2019

CVSS v3.1
6.4
EPSS
3%
Percentile
88.2
In the wild
Unconfirmed
What it is

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.03226 · 88.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2019-09-11T19:17Z
EPSS history
Timeline
  • 11 SEP 19:17Z
    The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability
    cvelistv5