CVE-2018-1245

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
RSA	RSA Identity Governance and Lifecycle	version 7.0.1, all patch levels; version 7.0.2, all patch levels; version 7.1.0, all patch levels

References

http://seclists.org/fulldisclosure/2018/Jul/46Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041287Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/46Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041287Third Party Advisory, VDB Entry

Timeline

Published: Jul 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124537.5Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-se CVE-2018-124547.5The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value CVE-2018-124558.1Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interfac CVE-2018-124568.8Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions CVE-2018-124578.8expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.CVE-2018-124586.5An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertio CVE-2018-124596.5An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger CVE-2018-12466.1Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially explo CVE-2018-124606.5libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI CVE-2018-124617.5Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.CVE-2018-124626.1NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.CVE-2018-124639.8An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated