description: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: RSA Identity Governance and Lifecycle
vendor: Dell
versions:
lessThan: 7.1.1 P02, status: affected, version: unspecified, versionType: custom
lessThan: 7.1.0 P08, status: affected, version: unspecified, versionType: custom
status: affected, version: 7.0.2
status: affected, version: 7.0.1
}
{
product: RSA Via Lifecycle and Governance
vendor: Dell
versions:
status: affected, version: 7.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]