CVE-2019-3760

MEDIUM

RSA Identity Governance and Lifecycle < 7.1.0 P08 - Authenticated SQL Injection in Workflow Architect

Title source: llm
STIX 2.1

Description

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application.

References (1)

Core 1
Core References
Various Sources x_refsource_misc
https://community.rsa.com/docs/DOC-106943

Scores

CVSS v3 6.4
EPSS 0.0017
EPSS Percentile 37.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Details

CWE
CWE-20 CWE-89
Status published
Products (5)
dell/rsa_identity_governance_and_lifecycle 7.0.1 (7 CPE variants)
dell/rsa_identity_governance_and_lifecycle 7.0.2 (15 CPE variants)
dell/rsa_identity_governance_and_lifecycle 7.1.0 (8 CPE variants)
dell/rsa_identity_governance_and_lifecycle 7.1.1 (2 CPE variants)
dell/rsa_via_lifecycle_and_governance 7.0.0 (6 CPE variants)
Published Sep 11, 2019
Tracked Since Feb 18, 2026