CVE-2017-8004

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-8004
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that may potentially contain a malicious code. The malicious file could be then executed on the affected system with the privileges of the user the application is running under.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://seclists.org/fulldisclosure/2017/Jul/24 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/99591 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038877 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1.3:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.4:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.5:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.6:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.9:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.10:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.11:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.12:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.13:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.14:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.15:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.16:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.17:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.18:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.19:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.20:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.21:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.22:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.23:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1.24:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.5:*:*:*:*:*:*:*
History

06 Aug 2021, 13:12

Type Values Removed Values Added
CPE cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0.0.5:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0.0.1:*:*:*:*:*:*:*		 cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.5:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:*:*:*:*:*:*:*
Information

Published : 2017-07-17 14:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-8004

Mitre link : CVE-2017-8004

CVE.ORG link : CVE-2017-8004

JSON object : View

Products Affected

rsa

  • rsa_via_lifecycle_and_governance

emc

  • rsa_identity_governance_and_lifecycle
  • rsa_identity_management_and_governance
CWE
CWE-20

Improper Input Validation