Session Fixation Vulnerability in RSA Identity Governance and Lifecycle Products

CVE-2019-18573

Summary

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products versions prior to 7.1.1 P03 are susceptible to a session fixation vulnerability. This weakness allows an authenticated local attacker to exploit the system by exposing session tokens through the URL. If exploited, a remote attacker could hijack the user’s session and execute actions with the same privileges as the victim, potentially compromising sensitive data and operations.

References