{"api_version":"1","generated_at":"2026-04-23T00:39:35+00:00","cve":"CVE-2019-7394","urls":{"html":"https://cve.report/CVE-2019-7394","api":"https://cve.report/api/cve/CVE-2019-7394.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-7394","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-7394"},"summary":{"title":"CVE-2019-7394","description":"A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.","state":"PUBLIC","assigner":"vuln@ca.com","published_at":"2019-05-28 19:29:00","updated_at":"2020-10-06 14:29:00"},"problem_types":["CWE-269"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html","name":"http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"CA Risk / Strong Authentication Privilege Escalation ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2019/May/43","name":"20190529 CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"],"title":"Full Disclosure: CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html","name":"https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","mime":"text/html","httpstatus":"500","archivestatus":"200"},{"url":"https://seclists.org/bugtraq/2019/May/66","name":"20190527 CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","refsource":"BUGTRAQ","tags":["Mailing List","Third Party Advisory"],"title":"Bugtraq: CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/108483","name":"108483","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Multiple CA Products Privilege Escalation and Information Disclosure Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7394","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7394","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"risk_authentication","cpe6":"3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"risk_authentication","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"risk_authentication","cpe6":"3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"risk_authentication","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"8.2.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"risk_authentication","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"strong_authentication","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"strong_authentication","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"strong_authentication","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"strong_authentication","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"7394","vulnerable":"1","versionEndIncluding":"8.2.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ca","cpe5":"strong_authentication","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"vuln@ca.com","DATE_PUBLIC":"2019-05-23T04:00:00.000Z","ID":"CVE-2019-7394","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"CA Strong Authentication","version":{"version_data":[{"version_affected":"=","version_name":"9","version_value":"9.0.x"},{"version_affected":"=","version_name":"8","version_value":"8.2.x"},{"version_affected":"=","version_name":"8","version_value":"8.1.x"},{"version_affected":"=","version_name":"8","version_value":"8.0.x"},{"version_name":"7","version_value":"7.1.x"}]}},{"product_name":"CA Risk Authentication","version":{"version_data":[{"version_affected":"=","version_name":"9","version_value":"9.0.x"},{"version_affected":"=","version_name":"8","version_value":"8.2.x"},{"version_affected":"=","version_name":"8","version_value":"8.1.x"},{"version_affected":"=","version_name":"8","version_value":"8.0.x"},{"version_name":"3","version_value":"3.1.x"}]}}]},"vendor_name":"CA Technologies, A Broadcom Company"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges."}]},"generator":{"engine":"Vulnogram 0.0.6"},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-269 Improper Privilege Management"}]}]},"references":{"reference_data":[{"refsource":"BUGTRAQ","name":"20190527 CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","url":"https://seclists.org/bugtraq/2019/May/66"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html","url":"http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html"},{"refsource":"BID","name":"108483","url":"http://www.securityfocus.com/bid/108483"},{"refsource":"CONFIRM","name":"https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html","url":"https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html"},{"refsource":"FULLDISC","name":"20190529 CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication","url":"http://seclists.org/fulldisclosure/2019/May/43"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2019-05-28 19:29:00","lastModifiedDate":"2020-10-06 14:29:00","problem_types":["CWE-269"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:risk_authentication:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndIncluding":"8.2.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:risk_authentication:3.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:risk_authentication:9.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:strong_authentication:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndIncluding":"8.2.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:strong_authentication:7.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ca:strong_authentication:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"7394","Ordinal":"145170","Title":"CVE-2019-7394","CVE":"CVE-2019-7394","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"7394","Ordinal":"1","NoteData":"A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"7394","Ordinal":"2","NoteData":"2019-05-28","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"7394","Ordinal":"3","NoteData":"2019-05-29","Type":"Other","Title":"Modified"}]}}}