CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2018/Mar/16	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/103317	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040458	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1:::::::*
	cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.2:::::::*
	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:::::::*
	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:::::::*
	cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:::::::*

History

06 Aug 2021, 13:12

Type	Values Removed	Values Added
CPE	cpe:2.3:a:emc:rsa_via_lifecycle_and_governance:7.0:::::::*	cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:::::::*

Information

Published : 2018-03-08 15:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-1182

Mitre link : CVE-2018-1182

CVE.ORG link : CVE-2018-1182

JSON object : View

Products Affected

emc

rsa_identity_governance_and_lifecycle
rsa_identity_management_and_governance

rsa

rsa_via_lifecycle_and_governance

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2018-1182", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-03-08T15:29:00.517", "references": [{"url": "http://seclists.org/fulldisclosure/2018/Mar/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/bid/103317", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1040458", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges."}, {"lang": "es", "value": "Se ha descubierto un problema en EMC RSA Identity Governance and Lifecycle en sus versiones 7.0.1 y 7.0.2 a todos los niveles de parcheo (solo dispositivos de hardware y paquetes de software); RSA Identity Management Governance (RSA IMG) en sus versiones 6.9.0 y 6.9.1 a todos los niveles de parcheo (solo dispositivos de hardware y paquetes de software). Permite que determinados usuarios a nivel de sistema operativo ejecuten scripts arbitrarios con privilegios root."}], "lastModified": "2021-08-06T13:12:07.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD65ECE7-AEC0-4996-AA77-A1394CD10E55"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5288389E-1322-4441-A295-045E38B22D11"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EFA9B3D-507A-49CD-9DA5-3CC984EE4E64"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8784E8C-B027-446D-92E3-E1FF3CA90BA2"}, {"criteria": "cpe:2.3:a:rsa:rsa_via_lifecycle_and_governance:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB09176-507F-4A9E-A316-561BE6D7725F"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}