CVE-2019-18573

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim’s session and perform arbitrary actions with privileges of the user within the compromised session.

Score

CVSS 3.1 8.8 High

Status

Modified - security_alert@emc.com

Published

2019-12-18

Last modified

2024-09-16

Weaknesses

CWE-384, CWE-598

Affected products

• Rsa Identity Governance And Lifecycle (Dell)
• Rsa Identity Governance Lifecycle (Dell)

References

• https://community.rsa.com/docs/DOC-109310