PT-2023-24009 · Unknown · Archer Platform

Published 2023-07-14 · Updated 2023-07-27 · CVE-2023-32760

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Archer Platform versions prior to 6.13

Description The issue allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication.

Recommendations For versions prior to 6.12.0.6, update to version 6.12.0.6 or later. For versions 6.12.0.6 and earlier than 6.13, update to version 6.13.0 or later. As a temporary workaround, consider restricting access to API calls related to data feeds and data publication until a patch is available.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-32760

Affected Products

Archer Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-32760 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32760 · Vendor Advisory
• https://archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362 · Vendor Advisory
• https://t.me/cibsecurity/66759 · Telegram Post
• https://archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821 · Note