CVE-2019-3763 Information disclosure in RSA Identity Governance and Lifecycle
An authenticated local user can read Office 365 passwords from debug logs, enabling account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3763?
CVE-2019-3763 is a high-severity vulnerability in Dell RSA Identity Governance and Lifecycle, published on 11 Sep 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Office 365 connector debug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use in further attacks.
Weakness: CWE-532
Which versions are affected by CVE-2019-3763?
It affects 2 products.
Products include Dell Rsa Identity Governance and Lifecycle, Dell Rsa via Lifecycle and Governance.
How do I fix CVE-2019-3763?
No fix has been published for CVE-2019-3763 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3763 being exploited?
There is no known exploitation of CVE-2019-3763 in the wild and no public exploit code.
Other vulnerabilities in Dell RSA Identity Governance and Lifecycle
- CVE-2019-18573 Other in RSA Identity Governance & Lifecycle
- CVE-2019-18572 Auth bypass in RSA Identity Governance & Lifecycle
- CVE-2019-3759 Code injection in RSA Identity Governance and Lifecycle
- CVE-2019-3760 SQL injection in RSA Identity Governance and Lifecycle
- CVE-2019-18571 Cross-site scripting in RSA Identity Governance & Lifecycle
Sources
Also known as GHSA-9j7f-32w8-q88p.