Session Fixation Vulnerability in RSA Identity Governance and Lifecycle Products
CVE-2019-18573

8.7HIGH

Key Information:

Vendor

Dell
Status
Rsa Identity Governance & Lifecycle
Vendor
CVE Published:
18 December 2019

What is CVE-2019-18573?

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products versions prior to 7.1.1 P03 are susceptible to a session fixation vulnerability. This weakness allows an authenticated local attacker to exploit the system by exposing session tokens through the URL. If exploited, a remote attacker could hijack the user’s session and execute actions with the same privileges as the victim, potentially compromising sensitive data and operations.

Affected Version(s)

RSA Identity Governance & Lifecycle < 7.1.0 P09, 7.1.1 P03

References

https://community.rsa.com/docs/DOC-109310
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.