CVE-2017-8005
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA…
Does this matter?
Lower severity and a low EPSS score (1.21%). Track it; it rarely justifies an emergency change on its own.
Description
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) are affected by multiple stored cross-site scripting vulnerabilities. Remote authenticated malicious users could potentially inject arbitrary HTML code to the application.
- CVSS 3.0
- 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.21% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- emc/rsa identity governance and lifecycle · emc/rsa identity management and governance · rsa/rsa via lifecycle and governance
- Source
- security_alert@emc.com
References
- http://seclists.org/fulldisclosure/2017/Jul/24Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99591Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038877Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Jul/24Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99591Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038877Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.