medium6.4Public exploit code
CVE-2019-3759
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- RSA IG&L Aveksa 7.1.1 - Remote Code Execution2020-07-06 · webapps · multiple
Impact
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dell | Rsa Identity Governance And Lifecycle | Versions 7.0.1, 7.0.2, 7.1.0, 7.1.1 |
| Dell | Rsa Via Lifecycle And Governance | Version 7.0.0 |