Privilege escalation in EMC Rsa Identity Governance And Lifecycle
CVE-2018-1182
An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (32.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 32.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- EMC Rsa Identity Governance And Lifecycle — versions 7.0.1, 7.0.2
- EMC Rsa Identity Management And Governance — versions 6.9.0, 6.9.1
- Rsa Via Lifecycle And Governance — versions 7.0
- EMC Rsa Identity Governance And Lifecycle Versions 7.0.1, 7.0.2, All Patch Levels (Hardware Appliance Software Bundle Deployments Only); Via Version 7.0, Management & (Rsa Img) 6.9.0, 6.9.1, Only) — versions EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only)
Weakness classification (CWE)
References
- www.securitytracker.com/id/1040458 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/103317 (VDB Entry, Third Party Advisory, vdb-entry)
- seclists.org/fulldisclosure/2018/Mar/16 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1182?
- CVE-2018-1182 is a high-severity vulnerability in EMC Rsa Identity Governance And Lifecycle, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2018-03-08.
- How severe is CVE-2018-1182?
- High severity. CVSS v3 base score is 7.8 out of 10.