Code injection in Dell RSA Identity Governance and Lifecycle
Priority MEDIUM 41CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.
Why it matters now
EPSS 0.03226 88th percentileScored 2026-11-07
Fix Fixed RSA Identity Governance and Lifecycle (Dell): 7.1.1 P02, 7.1.0 P08
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | RSA Identity Governance and Lifecycle | before 7.1.1 P02; before 7.1.0 P08; 7.0.2; 7.0.1 | 7.1.1 P02, 7.1.0 P08 | Patch available | CNA |
| Dell | RSA Via Lifecycle and Governance | 7.0 | — | No fix listed | CNA |
- RSA Identity Governance and Lifecycle VendorDell Affected before 7.1.1 P02; before 7.1.0 P08; 7.0.2; 7.0.1 Fixed in 7.1.1 P02, 7.1.0 P08 Patch available CNA
- RSA Via Lifecycle and Governance VendorDell Affected 7.0 Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:* | 7.0.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:* | 7.0.1 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:* | 7.0.1 p2_hotfix2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:* | 7.0.1 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:* | 7.0.1 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:* | 7.0.1 p5 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:* | 7.0.1 p5_hotfix2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:* | 7.0.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:* | 7.0.2 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:* | 7.0.2 p10 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:* Versions 7.0.1 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:* Versions 7.0.1 p2_hotfix2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:* Versions 7.0.1 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:* Versions 7.0.1 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:* Versions 7.0.1 p5 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:* Versions 7.0.1 p5_hotfix2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:* Versions 7.0.2 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:* Versions 7.0.2 p10 Vulnerable ·Dell
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p11:*:*:*:*:*:* | 7.0.2 p11 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p12:*:*:*:*:*:* | 7.0.2 p12 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p13:*:*:*:*:*:* | 7.0.2 p13 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p14:*:*:*:*:*:* | 7.0.2 p14 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p2:*:*:*:*:*:* | 7.0.2 p2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p3:*:*:*:*:*:* | 7.0.2 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p4:*:*:*:*:*:* | 7.0.2 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p5:*:*:*:*:*:* | 7.0.2 p5 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p6:*:*:*:*:*:* | 7.0.2 p6 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p7:*:*:*:*:*:* | 7.0.2 p7 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p8:*:*:*:*:*:* | 7.0.2 p8 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p9:*:*:*:*:*:* | 7.0.2 p9 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* | 7.1.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* | 7.1.0 p01 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* | 7.1.0 p02 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* | 7.1.0 p03 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* | 7.1.0 p04 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* | 7.1.0 p05 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* | 7.1.0 p06 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* | 7.1.0 p07 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* | 7.1.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p1:*:*:*:*:*:* | 7.1.1 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:-:*:*:*:*:*:* | 7.0.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p1:*:*:*:*:*:* | 7.0.0 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p2:*:*:*:*:*:* | 7.0.0 p2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p3:*:*:*:*:*:* | 7.0.0 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p4:*:*:*:*:*:* | 7.0.0 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p5:*:*:*:*:*:* | 7.0.0 p5 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p11:*:*:*:*:*:* Versions 7.0.2 p11 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p12:*:*:*:*:*:* Versions 7.0.2 p12 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p13:*:*:*:*:*:* Versions 7.0.2 p13 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p14:*:*:*:*:*:* Versions 7.0.2 p14 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p2:*:*:*:*:*:* Versions 7.0.2 p2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p3:*:*:*:*:*:* Versions 7.0.2 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p4:*:*:*:*:*:* Versions 7.0.2 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p5:*:*:*:*:*:* Versions 7.0.2 p5 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p6:*:*:*:*:*:* Versions 7.0.2 p6 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p7:*:*:*:*:*:* Versions 7.0.2 p7 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p8:*:*:*:*:*:* Versions 7.0.2 p8 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p9:*:*:*:*:*:* Versions 7.0.2 p9 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* Versions 7.1.0 p01 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* Versions 7.1.0 p02 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* Versions 7.1.0 p03 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* Versions 7.1.0 p04 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* Versions 7.1.0 p05 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* Versions 7.1.0 p06 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* Versions 7.1.0 p07 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p1:*:*:*:*:*:* Versions 7.1.1 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p1:*:*:*:*:*:* Versions 7.0.0 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p2:*:*:*:*:*:* Versions 7.0.0 p2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p3:*:*:*:*:*:* Versions 7.0.0 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p4:*:*:*:*:*:* Versions 7.0.0 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p5:*:*:*:*:*:* Versions 7.0.0 p5 Vulnerable ·Dell
Remediation
- Fix · CNA RSA Identity Governance and Lifecycle (Dell) Fixed in 7.1.1 P02, 7.1.0 P08
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dell RSA Identity Governance and Lifecycle 7.1.0 P08, 7.1.1 P02
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-02775 Improper input validation in Dell RSA Identity Governance and LifecyclePriority MEDIUM 40
- TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and LifecyclePriority LOW 38
- TI-2019-02776 Cross-site scripting in Dell RSA Identity Governance and LifecyclePriority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3759
- 2026-10-03 Alias added: GHSA-2j3c-m8j3-c8j2
References
More Dell Rsa Identity Governance And Lifecycle vulnerabilities
- TI-2019-13441 Missing authentication in Dell RSA Identity Governance & Lifecycle CVSS 3.1CRITICAL 9.8
- TI-2019-13442 Session fixation in Dell RSA Identity Governance & Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02775 Improper input validation in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02776 Cross-site scripting in Dell RSA Identity Governance and Lifecycle CVSS 3.1MEDIUM 5.4
- TI-2019-13440 Cross-site scripting in Dell RSA Identity Governance & Lifecycle CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-3759 · CVE Program
- CVE-2019-3759 · NVD
- FIRST EPSS
- GHSA-2j3c-m8j3-c8j2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences