Command Injection vulnerability
CVE-2019-3725

9.8CRITICAL

Key Information:

Vendor

Rsa
Status
Rsa Netwitness Platform
Rsa Security Analytics
Vendor
CVE Published:
15 May 2019

What is CVE-2019-3725?

RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server.

Affected Version(s)

RSA Netwitness Platform <= 11.2.1.1

RSA Security Analytics RSA Security Analytics <= 10.6.6.1

References

https://community.rsa.com/docs/DOC-104202
x_refsource_CONFIRM
http://www.securityfocus.com/bid/108355
vdb-entryx_refsource_BID

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

RSA would like to thank Nikolay Klendar for reporting CVE-2019-3725
.