CVE-2019-3724 - OpenCVE

RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Rsa	Netwitness Platform Security Analytics

Configuration 1 [-]

OR	cpe:2.3:a:rsa:netwitness_platform::::::::
	cpe:2.3:a:rsa:security_analytics::::::::

No data.

References

Link	Providers
https://community.rsa.com/docs/DOC-104202

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2019-05-15T15:45:11.690012Z

Updated: 2024-09-16T22:51:53.424Z

Reserved: 2019-01-03T00:00:00

Link: CVE-2019-3724

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-05-15T16:29:00.690

Modified: 2020-08-24T17:37:01.140

Link: CVE-2019-3724

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "RSA Netwitness Platform", "vendor": "RSA", "versions": [{"lessThanOrEqual": "11.2.1.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "RSA would like to thank Mantas Ju\u0161kauskas for reporting CVE-2019-3724."}], "datePublic": "2019-05-09T00:00:00", "descriptions": [{"lang": "en", "value": "RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Authorization Bypass Vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-22T17:16:26", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://community.rsa.com/docs/DOC-104202"}], "source": {"discovery": "UNKNOWN"}, "title": "Authorization Bypass VulnerabilityRSA Netwitness Platform", "x_generator": {"engine": "Vulnogram 0.0.6"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2019-05-09T05:00:00.000Z", "ID": "CVE-2019-3724", "STATE": "PUBLIC", "TITLE": "Authorization Bypass VulnerabilityRSA Netwitness Platform"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "RSA Netwitness Platform", "version": {"version_data": [{"version_affected": "<=", "version_value": "11.2.1.1"}]}}]}, "vendor_name": "RSA"}]}}, "credit": [{"lang": "eng", "value": "RSA would like to thank Mantas Ju\u0161kauskas for reporting CVE-2019-3724."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials."}]}, "generator": {"engine": "Vulnogram 0.0.6"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Authorization Bypass Vulnerability"}]}]}, "references": {"reference_data": [{"name": "https://community.rsa.com/docs/DOC-104202", "refsource": "CONFIRM", "url": "https://community.rsa.com/docs/DOC-104202"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:19:18.264Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://community.rsa.com/docs/DOC-104202"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-3724", "datePublished": "2019-05-15T15:45:11.690012Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-16T22:51:53.424Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rsa:netwitness_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "41B1F0DE-5A99-4D86-9FB2-A6B7BBF1A0B6", "versionEndExcluding": "11.2.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rsa:security_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "005EEB99-D812-41AB-8703-B1EA95D91B18", "versionEndExcluding": "10.6.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials."}, {"lang": "es", "value": "En RSA Netwitness Platform versiones anteriores a 11.2.1.1, esta expuesta a una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n. Un atacante remoto con bajos privilegios podr\u00eda explotar esta vulnerabilidad para conseguir acceso a la informaci\u00f3n administrativa, incluidas las credenciales."}], "id": "CVE-2019-3724", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2019-05-15T16:29:00.690", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://community.rsa.com/docs/DOC-104202"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}