vulnwire
5.4med

CVE-2017-5004

EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known

EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Stored Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.

Exploit prediction (EPSS)

0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.15.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • n/a RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels, RSA Via Lifecycle and Governance version 7.0, all patch levels, RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • securitytracker.com /id/1038648 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/98968 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/540693/30/0/threaded · x_refsource_CONFIRM, x_transferred
  • web.archive.org /web/20210116013250/http://www.securityfocus.com/archive/1/540693/30/0/threaded · Third Party Advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.