CVE-2018-1245

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.

Score

CVSS 3.0 9.0 Critical

Status

Modified - security_alert@emc.com

Published

2018-07-13

Last modified

2024-09-16

Weaknesses

CWE-863

Affected products

• Rsa Identity Governance And Lifecycle (Emc)
• Rsa Identity Governance And Lifecycle (Rsa)

References

• http://seclists.org/fulldisclosure/2018/Jul/46
• http://www.securitytracker.com/id/1041287