Privilege escalation in EMC Rsa Identity Governance And Lifecycle

CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.

Vulnerability class: Privilege Escalation

EPSS: 0.004 (34.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Emc Rsa_identity_governance_and_lifecycle — versions 7.0.1, 7.0.2
  • Emc Rsa_identity_management_and_governance — versions 6.9.0, 6.9.1
  • Rsa Rsa_via_lifecycle_and_governance — versions 7.0
  • N/a Emc Rsa Identity Governance And Lifecycle Versions 7.0.1, 7.0.2, All Patch Levels (Hardware Appliance Software Bundle Deployments Only); Via Version 7.0, Management & (Rsa Img) 6.9.0, 6.9.1, Only) — versions EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only)

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2018-1182?
CVE-2018-1182 is a high-severity vulnerability in EMC Rsa Identity Governance And Lifecycle, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2018-03-08.
How severe is CVE-2018-1182?
High severity. CVSS v3 base score is 7.8 out of 10.