PT-2022-10714 · Rsa · Rsa Archer

Angelo Alviar + 2 · Published 2022-03-30 · Updated 2022-07-12 · CVE-2021-38362

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RSA Archer versions 6.x through 6.9 SP3 (6.9.3.0)

Description An authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

Recommendations For RSA Archer versions 6.x through 6.9 SP3 (6.9.3.0), as a temporary workaround, consider restricting access to the vulnerable REST API endpoint until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-38362

Affected Products

Rsa Archer

References · 7

• https://osv.dev/vulnerability/CVE-2021-38362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38362 · Security Note
• https://github.com/fireeye/Vulnerability-Disclosures · Note
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.md · Note
• https://t.me/cibsecurity/39887 · Telegram Post
• https://archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497 · Note
• https://t.me/cvenotify/28492 · Telegram Post