CVE-2019-7394
First published: Tue May 28 2019(Updated: )
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
Credit: vuln@ca.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CA Risk Authentication | >=8.0<=8.2.1 | |
| CA Risk Authentication | =3.1 | |
| CA Risk Authentication | =9.0 | |
| CA Strong Authentication | >=8.0<=8.2.1 | |
| CA Strong Authentication | =7.1 | |
| CA Strong Authentication | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2019/May/43
- http://www.securityfocus.com/bid/108483
- https://seclists.org/bugtraq/2019/May/66
- https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html
Frequently Asked Questions
What is the severity of CVE-2019-7394?
CVE-2019-7394 has been classified as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2019-7394?
To fix CVE-2019-7394, it is recommended to update CA Strong Authentication and CA Risk Authentication to the latest versions that address this vulnerability.
Who is affected by CVE-2019-7394?
CVE-2019-7394 affects users of CA Strong Authentication and CA Risk Authentication versions 7.1, 8.0 to 8.2.1, and 9.0.
What type of attack does CVE-2019-7394 allow?
CVE-2019-7394 allows an authenticated attacker to escalate privileges within the administrative user interface.
Is CVE-2019-7394 a remote vulnerability?
CVE-2019-7394 is not a remote vulnerability; it requires an authenticated user to exploit it.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/ca
- canonical/ca risk authentication
- version/ca risk authentication/8.0
- version/ca risk authentication/8.2.1
- version/ca risk authentication/3.1
- version/ca risk authentication/9.0
- canonical/ca strong authentication
- version/ca strong authentication/8.0
- version/ca strong authentication/8.2.1
- version/ca strong authentication/7.1
- version/ca strong authentication/9.0