Stored Cross-Site Scripting Vulnerability in RSA Identity Governance and Lifecycle Software

CVE-2019-3761

Summary

The RSA Identity Governance and Lifecycle software, along with the RSA Via Lifecycle and Governance products, prior to version 7.1.0 P08 are susceptible to a stored cross-site scripting vulnerability within the Access Request module. An authenticated remote user could exploit this vulnerability to inject malicious HTML or JavaScript code, which would subsequently be stored in a trusted application data store. As a result, when other users interact with this data store via their web browsers, the injected code would execute within the context of the vulnerable web application, compromising the integrity of the application and potentially leading to unauthorized actions.

References