CVE-2019-7394
CA Risk / Strong Authentication Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
Vulnerabilidad de escalado de privilegios en la interfaz de usuario administrativa de CA Technologies CA Strong Authentication 9.0. x, 8.2. x, 8.1. x, 8.0. x, 7.1. x y CA Risk Authentication 9.0. x, 8.2. x, 8.1. x, 8.0. x, 3.1. x permite que un atacante autenticado gane privilegios adicionales en algunos casos donde una cuenta tiene privilegios personalizados y limitados.
The Support team for CA Technologies, A Broadcom Company, is alerting customers to multiple potential risks with CA Risk Authentication and CA Strong Authentication. Multiple vulnerabilities exist that can allow a remote attacker to gain additional access in certain configurations or possibly gain sensitive information. CA published solutions to address the vulnerabilities and recommends that all affected customers implement these solutions immediately. The first vulnerability occurs due to insufficient verification of custom privileges. A malicious actor, who has access to an account with customized and limited privileges may, in some cases, access resources and act outside of assigned privileges. This exposure does not affect installations where accounts do not have custom privileges. The second vulnerability may enable a malicious actor to conduct UI redress attacks to gain sensitive information in some cases. Affected includes CA Risk Authentication versions 9.0, 8.x, and 3.1 as well as CA Strong Authentication versions 9.0, 8.x, and 7.1.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-02-04 CVE Reserved
- 2019-05-24 CVE Published
- 2024-09-17 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html | Third Party Advisory |
|
http://seclists.org/fulldisclosure/2019/May/43 | Mailing List |
|
http://www.securityfocus.com/bid/108483 | Third Party Advisory | |
https://seclists.org/bugtraq/2019/May/66 | Mailing List |
|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ca Search vendor "Ca" | Risk Authentication Search vendor "Ca" for product "Risk Authentication" | >= 8.0 <= 8.2.1 Search vendor "Ca" for product "Risk Authentication" and version " >= 8.0 <= 8.2.1" | - |
Affected
| ||||||
Ca Search vendor "Ca" | Risk Authentication Search vendor "Ca" for product "Risk Authentication" | 3.1 Search vendor "Ca" for product "Risk Authentication" and version "3.1" | - |
Affected
| ||||||
Ca Search vendor "Ca" | Risk Authentication Search vendor "Ca" for product "Risk Authentication" | 9.0 Search vendor "Ca" for product "Risk Authentication" and version "9.0" | - |
Affected
| ||||||
Ca Search vendor "Ca" | Strong Authentication Search vendor "Ca" for product "Strong Authentication" | >= 8.0 <= 8.2.1 Search vendor "Ca" for product "Strong Authentication" and version " >= 8.0 <= 8.2.1" | - |
Affected
| ||||||
Ca Search vendor "Ca" | Strong Authentication Search vendor "Ca" for product "Strong Authentication" | 7.1 Search vendor "Ca" for product "Strong Authentication" and version "7.1" | - |
Affected
| ||||||
Ca Search vendor "Ca" | Strong Authentication Search vendor "Ca" for product "Strong Authentication" | 9.0 Search vendor "Ca" for product "Strong Authentication" and version "9.0" | - |
Affected
|