Cross-site scripting in Dell RSA Identity Governance & Lifecycle
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.
Why it matters now
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed RSA Identity Governance & Lifecycle (Dell): 7.1.0 P09, 7.1.1 P3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | RSA Identity Governance & Lifecycle | before 7.1.0 P09, 7.1.1 P3 | 7.1.0 P09, 7.1.1 P3 | Patch available | CNA |
- RSA Identity Governance & Lifecycle VendorDell Affected before 7.1.0 P09, 7.1.1 P3 Fixed in 7.1.0 P09, 7.1.1 P3 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:* | 7.0.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* | 7.1.0 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* | 7.1.0 p01 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* | 7.1.0 p02 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* | 7.1.0 p03 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* | 7.1.0 p04 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* | 7.1.0 p05 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* | 7.1.0 p06 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* Versions 7.1.0 p01 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* Versions 7.1.0 p02 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* Versions 7.1.0 p03 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* Versions 7.1.0 p04 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* Versions 7.1.0 p05 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* Versions 7.1.0 p06 Vulnerable ·Dell
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* | 7.1.0 p07 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:* | 7.1.0 p08 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* | 7.1.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:* | 7.1.1 p01 | Vulnerable | Dell |
| cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:* | 7.1.1 p02 | Vulnerable | Dell |
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* Versions 7.1.0 p07 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:* Versions 7.1.0 p08 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:* Versions 7.1.1 p01 Vulnerable ·Dell
- cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:* Versions 7.1.1 p02 Vulnerable ·Dell
Remediation
- Fix · CNA RSA Identity Governance & Lifecycle (Dell) Fixed in 7.1.0 P09, 7.1.1 P3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18571
- 2026-10-03 Alias added: GHSA-2m88-ww7m-8xfj
References
More Dell Rsa Identity Governance And Lifecycle vulnerabilities
- TI-2019-13441 Missing authentication in Dell RSA Identity Governance & Lifecycle CVSS 3.1CRITICAL 9.8
- TI-2019-02774 Code injection in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.1
- TI-2019-13442 Session fixation in Dell RSA Identity Governance & Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02775 Improper input validation in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
- TI-2019-02776 Cross-site scripting in Dell RSA Identity Governance and Lifecycle CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-18571 · CVE Program
- CVE-2019-18571 · NVD
- FIRST EPSS
- GHSA-2m88-ww7m-8xfj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences