CVE-2018-1182

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.

Se ha descubierto un problema en EMC RSA Identity Governance and Lifecycle en sus versiones 7.0.1 y 7.0.2 a todos los niveles de parcheo (solo dispositivos de hardware y paquetes de software); RSA Identity Management Governance (RSA IMG) en sus versiones 6.9.0 y 6.9.1 a todos los niveles de parcheo (solo dispositivos de hardware y paquetes de software). Permite que determinados usuarios a nivel de sistema operativo ejecuten scripts arbitrarios con privilegios root.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-12-06 CVE Reserved
2018-03-06 CVE Published
2024-01-16 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-269: Improper Privilege Management

CAPEC

References (3)

URL	Tag	Source
http://seclists.org/fulldisclosure/2018/Mar/16	Mailing List
http://www.securityfocus.com/bid/103317	Third Party Advisory
http://www.securitytracker.com/id/1040458	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Emc Search vendor "Emc"		Rsa Identity Governance And Lifecycle Search vendor "Emc" for product "Rsa Identity Governance And Lifecycle"				7.0.1 Search vendor "Emc" for product "Rsa Identity Governance And Lifecycle" and version "7.0.1"		-		Affected
Emc Search vendor "Emc"		Rsa Identity Governance And Lifecycle Search vendor "Emc" for product "Rsa Identity Governance And Lifecycle"				7.0.2 Search vendor "Emc" for product "Rsa Identity Governance And Lifecycle" and version "7.0.2"		-		Affected
Emc Search vendor "Emc"		Rsa Identity Management And Governance Search vendor "Emc" for product "Rsa Identity Management And Governance"				6.9.0 Search vendor "Emc" for product "Rsa Identity Management And Governance" and version "6.9.0"		-		Affected
Emc Search vendor "Emc"		Rsa Identity Management And Governance Search vendor "Emc" for product "Rsa Identity Management And Governance"				6.9.1 Search vendor "Emc" for product "Rsa Identity Management And Governance" and version "6.9.1"		-		Affected
Rsa Search vendor "Rsa"		Rsa Via Lifecycle And Governance Search vendor "Rsa" for product "Rsa Via Lifecycle And Governance"				7.0 Search vendor "Rsa" for product "Rsa Via Lifecycle And Governance" and version "7.0"		-		Affected