RSA Via Lifecycle & Governance Information Defined in User Detail Popups

4 years ago

Originally Published: 2016-06-02

Article Number

000050419

Applies To

RSA Product Set: RSA Via Lifecycle & Governance
RSA Product/Service Type: Identity Management and Governance
RSA Version/Condition: 6.8.1 P01 - P24, 6.9.1 P01 - P14, 7.0.0 P01 - P03

Issue

Due to a potential security vulnerability in RSA Via Lifecycle & Governance (RSA Via L&G) the product now restricts how much information about a user is displayed in the Edit Attributes pop-up screen.. If a user that is privileged to see the user opens the Edit Attributes pop-up screen, all attributes are displayed. For non-privileged users, only the user’s name, title, business unit and availability status are shown.

Prior to this change, non-privileged users could access this view allowing them to view all the details for users they were not authorized to view.

Cause

Lack of security checks when display the user dialog.

Resolution

The following RSA Via Lifecycle and Governance releases contain resolutions to these vulnerabilities:

RSA Identity Management and Governance 6.8.1 P25
RSA Identity Management and Governance 6.9.1 P15, and
RSA Via Lifecycle and Governance 7.0.0 P04

Workaround

There is no work around for this issue. Please patch to the listed versions.

Don't see what you're looking for?

Related Articles

Trending Articles