CVE-2018-11049

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.

CVSS v3 7.3 HIGH
CVSS v2.0 6.9 MEDIUM

7.3^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2018/Jul/23	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/104722	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041228	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.1.0:::::::*
	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:::::::*
	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:::::::*
	cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:::::::*

History

No history.

Information

Published : 2018-07-11 20:29

Updated : 2024-02-28 16:48

NVD link : CVE-2018-11049

Mitre link : CVE-2018-11049

CVE.ORG link : CVE-2018-11049

JSON object : View

Products Affected

rsa

rsa_via_lifecycle_and_governance

emc

rsa_identity_management_and_governance
rsa_identity_governance_and_lifecycle

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2018-11049", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2018-07-11T20:29:00.320", "references": [{"url": "http://seclists.org/fulldisclosure/2018/Jul/23", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/bid/104722", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1041228", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system."}, {"lang": "es", "value": "RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance y RSA IMG tienen una vulnerabilidad de b\u00fasqueda no controlada. Los scripts de instalaci\u00f3n establecen una variable de entorno de forma no planeada. Un usuario malicioso local autenticado podr\u00eda enga\u00f1ar al usuario root para que ejecute c\u00f3digo malicioso en el sistema objetivo."}], "lastModified": "2021-08-06T13:12:07.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E12BFEB-1BFD-49BC-9EAC-B9A7C57B8ABD"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EFA9B3D-507A-49CD-9DA5-3CC984EE4E64"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8784E8C-B027-446D-92E3-E1FF3CA90BA2"}, {"criteria": "cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB09176-507F-4A9E-A316-561BE6D7725F"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}