Cross-site scripting in Dell RSA Identity Governance and Lifecycle
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application.
Why it matters now
EPSS 0.00785 56th percentileScored 2026-11-07
Fix Fixed RSA Identity Governance and Lifecycle (Dell): 7.1.1 P02, 7.1.0 P08
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | RSA Identity Governance and Lifecycle | before 7.1.1 P02; before 7.1.0 P08; 7.0.2; 7.0.1 | 7.1.1 P02, 7.1.0 P08 | Patch available | CNA |
| Dell | RSA Via Lifecycle and Governance | 7.0 | — | No fix listed | CNA |
- RSA Identity Governance and Lifecycle VendorDell Affected before 7.1.1 P02; before 7.1.0 P08; 7.0.2; 7.0.1 Fixed in 7.1.1 P02, 7.1.0 P08 Patch available CNA
- RSA Via Lifecycle and Governance VendorDell Affected 7.0 Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:* | 7.0.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:* | 7.0.1 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:* | 7.0.1 p2_hotfix2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:* | 7.0.1 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:* | 7.0.1 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:* | 7.0.1 p5 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:* | 7.0.1 p5_hotfix2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:* | 7.0.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:* | 7.0.2 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:* | 7.0.2 p10 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:-:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p1:*:*:*:*:*:* Versions 7.0.1 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p2_hotfix2:*:*:*:*:*:* Versions 7.0.1 p2_hotfix2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p3:*:*:*:*:*:* Versions 7.0.1 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p4:*:*:*:*:*:* Versions 7.0.1 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5:*:*:*:*:*:* Versions 7.0.1 p5 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:p5_hotfix2:*:*:*:*:*:* Versions 7.0.1 p5_hotfix2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:-:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p1:*:*:*:*:*:* Versions 7.0.2 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p10:*:*:*:*:*:* Versions 7.0.2 p10 Vulnerable ·Dell
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p11:*:*:*:*:*:* | 7.0.2 p11 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p12:*:*:*:*:*:* | 7.0.2 p12 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p13:*:*:*:*:*:* | 7.0.2 p13 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p14:*:*:*:*:*:* | 7.0.2 p14 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p2:*:*:*:*:*:* | 7.0.2 p2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p3:*:*:*:*:*:* | 7.0.2 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p4:*:*:*:*:*:* | 7.0.2 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p5:*:*:*:*:*:* | 7.0.2 p5 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p6:*:*:*:*:*:* | 7.0.2 p6 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p7:*:*:*:*:*:* | 7.0.2 p7 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p8:*:*:*:*:*:* | 7.0.2 p8 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p9:*:*:*:*:*:* | 7.0.2 p9 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* | 7.1.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* | 7.1.0 p01 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* | 7.1.0 p02 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* | 7.1.0 p03 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* | 7.1.0 p04 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* | 7.1.0 p05 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* | 7.1.0 p06 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* | 7.1.0 p07 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* | 7.1.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p1:*:*:*:*:*:* | 7.1.1 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:-:*:*:*:*:*:* | 7.0.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p1:*:*:*:*:*:* | 7.0.0 p1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p2:*:*:*:*:*:* | 7.0.0 p2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p3:*:*:*:*:*:* | 7.0.0 p3 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p4:*:*:*:*:*:* | 7.0.0 p4 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p5:*:*:*:*:*:* | 7.0.0 p5 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p11:*:*:*:*:*:* Versions 7.0.2 p11 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p12:*:*:*:*:*:* Versions 7.0.2 p12 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p13:*:*:*:*:*:* Versions 7.0.2 p13 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p14:*:*:*:*:*:* Versions 7.0.2 p14 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p2:*:*:*:*:*:* Versions 7.0.2 p2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p3:*:*:*:*:*:* Versions 7.0.2 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p4:*:*:*:*:*:* Versions 7.0.2 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p5:*:*:*:*:*:* Versions 7.0.2 p5 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p6:*:*:*:*:*:* Versions 7.0.2 p6 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p7:*:*:*:*:*:* Versions 7.0.2 p7 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p8:*:*:*:*:*:* Versions 7.0.2 p8 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:p9:*:*:*:*:*:* Versions 7.0.2 p9 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* Versions 7.1.0 p01 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* Versions 7.1.0 p02 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* Versions 7.1.0 p03 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* Versions 7.1.0 p04 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* Versions 7.1.0 p05 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* Versions 7.1.0 p06 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* Versions 7.1.0 p07 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p1:*:*:*:*:*:* Versions 7.1.1 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p1:*:*:*:*:*:* Versions 7.0.0 p1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p2:*:*:*:*:*:* Versions 7.0.0 p2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p3:*:*:*:*:*:* Versions 7.0.0 p3 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p4:*:*:*:*:*:* Versions 7.0.0 p4 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_via_lifecycle_and_governance:7.0.0:p5:*:*:*:*:*:* Versions 7.0.0 p5 Vulnerable ·Dell
Remediation
- Fix · CNA RSA Identity Governance and Lifecycle (Dell) Fixed in 7.1.1 P02, 7.1.0 P08
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dell RSA Identity Governance and Lifecycle 7.1.0 P08, 7.1.1 P02
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-02774 Code injection in Dell RSA Identity Governance and LifecyclePriority MEDIUM 41
- TI-2019-02775 Improper input validation in Dell RSA Identity Governance and LifecyclePriority MEDIUM 40
- TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and LifecyclePriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3761
- 2026-10-03 Alias added: GHSA-crf5-7393-h8jv
References
More Dell Rsa Identity Governance And Lifecycle vulnerabilities
- TI-2019-13441 Missing authentication in Dell RSA Identity Governance & Lifecycle CVSS 3.1CRITICAL 9.8
- TI-2019-02774 Code injection in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.1
- TI-2019-13442 Session fixation in Dell RSA Identity Governance & Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02775 Improper input validation in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-13440 Cross-site scripting in Dell RSA Identity Governance & Lifecycle CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-3761 · CVE Program
- CVE-2019-3761 · NVD
- FIRST EPSS
- GHSA-crf5-7393-h8jv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences