CVE-2019-7394

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
CA Technologies, A Broadcom Company	CA Strong Authentication	9.0.x; 8.2.x; 8.1.x; 8.0.x; 7.1.x
CA Technologies, A Broadcom Company	CA Risk Authentication	9.0.x; 8.2.x; 8.1.x; 8.0.x; 3.1.x

References

http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/May/43Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108483Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/May/66Mailing List, Third Party Advisory
https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.htmlVendor Advisory
http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/May/43Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108483Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/May/66Mailing List, Third Party Advisory
https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.htmlVendor Advisory

Timeline

Published: May 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-73957.5In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.CVE-2019-73967.5In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.CVE-2019-73977.5In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.CVE-2019-73987.5In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.CVE-2019-73997.4Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.CVE-2019-74006.1Rukovoditel before 2.4.1 allows XSS.CVE-2019-74019.8NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request CVE-2019-74026.1An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can CVE-2019-74034.9An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=imp CVE-2019-74047.5An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request c CVE-2019-74096.1Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or CVE-2019-74106.1There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $