CVE-2018-1245: RSA Identity Governance and Lifecycle

Описание

Оригинално описание

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.

Засегнати продукти

• RSA RSA Identity Governance and Lifecycle: version 7.0.1, all patch levels; version 7.0.2, all patch levels; version 7.1.0, all patch levels

История

Други уязвимости в RSA RSA Identity Governance and Lifecycle

• 6.1CVE-2018-1255

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2018-1245
• https://nvd.nist.gov/vuln/detail/CVE-2018-1245
• http://www.securitytracker.com/id/1041287
• http://seclists.org/fulldisclosure/2018/Jul/46