Read the docs
TI-2019-13442 Aliases CVE-2019-18573GHSA-h25m-5xq7-8h6q

Session fixation in Dell RSA Identity Governance & Lifecycle

Priority MEDIUM 40CWE-598Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-384.

Summary

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim’s session and perform arbitrary actions with privileges of the user within the compromised session.

Why it matters now

EPSS 0.00986 62nd percentileScored 2026-11-07
Fix Fixed RSA Identity Governance & Lifecycle (Dell): 7.1.0 P09, 7.1.1 P03

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellRSA Identity Governance & Lifecyclebefore 7.1.0 P09, 7.1.1 P037.1.0 P09, 7.1.1 P03Patch availableCNA
  • RSA Identity Governance & Lifecycle VendorDell Affected before 7.1.0 P09, 7.1.1 P03 Fixed in 7.1.0 P09, 7.1.1 P03 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:*7.0VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:*7.1.0VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:*7.1.0 p01VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:*7.1.0 p02VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:*7.1.0 p03VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:*7.1.0 p04VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:*7.1.0 p05VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:*7.1.0 p06VulnerableDell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p01:*:*:*:*:*:* Versions 7.1.0 p01 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p02:*:*:*:*:*:* Versions 7.1.0 p02 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p03:*:*:*:*:*:* Versions 7.1.0 p03 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p04:*:*:*:*:*:* Versions 7.1.0 p04 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p05:*:*:*:*:*:* Versions 7.1.0 p05 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p06:*:*:*:*:*:* Versions 7.1.0 p06 Vulnerable ·Dell
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:*7.1.0 p07VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:*7.1.0 p08VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:*7.1.1VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:*7.1.1 p01VulnerableDell
cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:*7.1.1 p02VulnerableDell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p07:*:*:*:*:*:* Versions 7.1.0 p07 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.0:p08:*:*:*:*:*:* Versions 7.1.0 p08 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:-:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p01:*:*:*:*:*:* Versions 7.1.1 p01 Vulnerable ·Dell
  • cpe:2.3:a:dell:rsa_identity_governance_and_lifecycle:7.1.1:p02:*:*:*:*:*:* Versions 7.1.1 p02 Vulnerable ·Dell

Remediation

  • Fix · CNA RSA Identity Governance & Lifecycle (Dell) Fixed in 7.1.0 P09, 7.1.1 P03

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell RSA Identity Governance & Lifecycle 7.1.0 P09, 7.1.1 P03

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2019-13441 Missing authentication in Dell RSA Identity Governance & LifecyclePriority MEDIUM 46
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18573
  2. 2026-10-03 Alias added: GHSA-h25m-5xq7-8h6q

References

Other 1

  • TI-2019-13441 Missing authentication in Dell RSA Identity Governance & Lifecycle CVSS 3.1CRITICAL 9.8
  • TI-2019-02774 Code injection in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.1
  • TI-2019-02775 Improper input validation in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
  • TI-2019-02778 Sensitive information in log files in Dell RSA Identity Governance and Lifecycle CVSS 3.1HIGH 8.8
  • TI-2019-02776 Cross-site scripting in Dell RSA Identity Governance and Lifecycle CVSS 3.1MEDIUM 5.4
  • TI-2019-13440 Cross-site scripting in Dell RSA Identity Governance & Lifecycle CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences