CVE-2019-18571

Estado: ModificadaMedia (5.4)—

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Puntuación base: 5.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.50%
Percentil entre todas las CVEs puntuadas: 41
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1204.002 Malicious Fileexecution
Impacto principalT1059.007 JavaScriptexecution
Impacto secundarioT1185 Browser Session Hijackingcollection

Fuente: mapeo oficial MITRE CTID (CVE → ATT&CK).

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Training Execution Prevention Behavior Prevention on Endpoint User Account Management Restrict Web-Based Content Disable or Remove Feature or Program

Tecnologías afectadas (1)

Dell — RSA Identity Governance AND Lifecycle

CWE

CWE-79
CWE-79

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2019-18571",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "RSA Identity Governance & Lifecycle",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.1.0 P09, 7.1.1 P3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-18T21:15:12.833",
  "references": [
    {
      "url": "https://community.rsa.com/docs/DOC-109310",
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://community.rsa.com/docs/DOC-109310",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application."
    },
    {
      "lang": "es",
      "value": "Los productos RSA Identity Governance and Lifecycle y RSA Via Lifecycle and Governance versiones anteriores a 7.1.1 P03, contienen una vulnerabilidad de tipo cross-site scripting reflejado en el módulo My Access Live [MAL]. Un usuario local malicioso autenticado podría explotar potencialmente esta vulnerabilidad mediante el envío de una URL diseñada con scripts. Cuando los usuarios víctimas acceden al módulo por medio de sus navegadores, el código malicioso es insertado y ejecutado mediante el navegador web en el contexto de la aplicación web vulnerable."
    }
  ],
  "lastModified": "2026-06-17T02:25:06.767",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54F243EB-5F06-4728-8815-93BDB5502F74"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD518D4A-157A-42D8-B958-8C4661CE6224"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2715882-4E9F-4E4C-A648-30B5D8B36C63"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC3F7997-46CC-4345-981A-4CA38A73BA8C"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD36DED8-5591-4A76-AD40-7DAED6EF1954"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CF203FD-8A59-4237-820A-FDBE4F28E4B9"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08FC40D4-433A-4EDE-87B1-422D0473D6D8"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CF1C39E-D12B-44E4-8172-CD91F17E871B"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31DCF79D-E1EA-4F65-B355-C821B0D78E73"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82CFC850-4C98-42B5-AE77-592FD64E78E1"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DE35E51-0C69-41A8-9332-A9E411CE0B92"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8989E78-229D-47B1-A60F-50394D8DF244"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E9E1900-FE59-440A-87D6-35DE7233EAB3"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15371ECD-CACD-4E1F-854B-D5EA6D1BBC54"
            },
            {
              "criteria": "cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACD868A6-05CC-4BCF-BC53-EA4418DE5F45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}