PT-2022-23925 · Rsa · Archer Platform

Published 2022-08-25 · Updated 2022-08-29 · CVE-2022-37318

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AC:H/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Archer Platform versions prior to 6.11 P3 (6.11.0.3)

Description The issue allows a remote unauthenticated malicious user to potentially exploit a reflected XSS vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application.

Recommendations For versions prior to 6.11 P3 (6.11.0.3), update to a fixed release such as 6.11 P3 (6.11.0.3) or later. As a temporary workaround, consider restricting access to the vulnerable web application until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37318

Affected Products

Archer Platform

References · 4

• https://archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37318 · Security Note
• https://archerirm.com · Note