What is CVE-2018-11049?

CVE-2018-11049 is a high-severity vulnerability in EMC Rsa Identity Governance And Lifecycle, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2018-07-11.

How severe is CVE-2018-11049?

High severity. CVSS v3 base score is 7.3 out of 10.

Vulnerability in EMC Rsa Identity Governance And Lifecycle

CVE-2018-11049

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.

Published 2018-07-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.004 (36.2th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

EMC Rsa Identity Governance And Lifecycle — versions 7.1.0
EMC Rsa Identity Management And Governance — versions 6.9.0, 6.9.1
Pivotal Operations Manager — versions RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (Hardware Appliance and Software Bundle (also known as Soft-Appliance) deployments only)., RSA Via Lifecycle and Governance version 7.0, all patch levels (Hardware Appliance and Software Bundle (also known as Soft-Appliance) deployments only), RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (Hardware Appliance and Software Bundle (also known as Soft-Appliance) deployments only)
Rsa Via Lifecycle And Governance — versions 7.0

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

References

www.securityfocus.com/bid/104722 (VDB Entry, Third Party Advisory, vdb-entry)
seclists.org/fulldisclosure/2018/Jul/23 (mailing-list, Mailing List, Third Party Advisory)
www.securitytracker.com/id/1041228 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2018-11049?: CVE-2018-11049 is a high-severity vulnerability in EMC Rsa Identity Governance And Lifecycle, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2018-07-11.
How severe is CVE-2018-11049?: High severity. CVSS v3 base score is 7.3 out of 10.