// For flags

CVE-2019-7394

CA Risk / Strong Authentication Privilege Escalation

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.

Vulnerabilidad de escalado de privilegios en la interfaz de usuario administrativa de CA Technologies CA Strong Authentication 9.0. x, 8.2. x, 8.1. x, 8.0. x, 7.1. x y CA Risk Authentication 9.0. x, 8.2. x, 8.1. x, 8.0. x, 3.1. x permite que un atacante autenticado gane privilegios adicionales en algunos casos donde una cuenta tiene privilegios personalizados y limitados.

The Support team for CA Technologies, A Broadcom Company, is alerting customers to multiple potential risks with CA Risk Authentication and CA Strong Authentication. Multiple vulnerabilities exist that can allow a remote attacker to gain additional access in certain configurations or possibly gain sensitive information. CA published solutions to address the vulnerabilities and recommends that all affected customers implement these solutions immediately. The first vulnerability occurs due to insufficient verification of custom privileges. A malicious actor, who has access to an account with customized and limited privileges may, in some cases, access resources and act outside of assigned privileges. This exposure does not affect installations where accounts do not have custom privileges. The second vulnerability may enable a malicious actor to conduct UI redress attacks to gain sensitive information in some cases. Affected includes CA Risk Authentication versions 9.0, 8.x, and 3.1 as well as CA Strong Authentication versions 9.0, 8.x, and 7.1.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-02-04 CVE Reserved
  • 2019-05-24 CVE Published
  • 2024-09-17 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ca
Search vendor "Ca"
Risk Authentication
Search vendor "Ca" for product "Risk Authentication"
>= 8.0 <= 8.2.1
Search vendor "Ca" for product "Risk Authentication" and version " >= 8.0 <= 8.2.1"
-
Affected
Ca
Search vendor "Ca"
Risk Authentication
Search vendor "Ca" for product "Risk Authentication"
3.1
Search vendor "Ca" for product "Risk Authentication" and version "3.1"
-
Affected
Ca
Search vendor "Ca"
Risk Authentication
Search vendor "Ca" for product "Risk Authentication"
9.0
Search vendor "Ca" for product "Risk Authentication" and version "9.0"
-
Affected
Ca
Search vendor "Ca"
Strong Authentication
Search vendor "Ca" for product "Strong Authentication"
>= 8.0 <= 8.2.1
Search vendor "Ca" for product "Strong Authentication" and version " >= 8.0 <= 8.2.1"
-
Affected
Ca
Search vendor "Ca"
Strong Authentication
Search vendor "Ca" for product "Strong Authentication"
7.1
Search vendor "Ca" for product "Strong Authentication" and version "7.1"
-
Affected
Ca
Search vendor "Ca"
Strong Authentication
Search vendor "Ca" for product "Strong Authentication"
9.0
Search vendor "Ca" for product "Strong Authentication" and version "9.0"
-
Affected