PT-2024-25697 · Rsa · Archer Platform

Published 2024-05-06 · Updated 2025-03-18 · CVE-2024-34089

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R

Name of the Vulnerable Software and Affected Versions Archer Platform versions prior to 2024.04 Archer Platform version 6.14.0.3 is a fixed release, implying versions prior to 6.14.0.3 are also vulnerable, but since 6.14 P3 (6.14.0.3) is mentioned as a fixed release, it simplifies the affected range to before 2024.04.

Description A stored cross-site scripting (XSS) issue allows a remote authenticated malicious Archer user to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.

Recommendations For Archer Platform versions prior to 2024.04, update to version 6.14.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the data store to minimize the risk of exploitation until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34089

Affected Products

Archer Platform

References · 9

• https://osv.dev/vulnerability/CVE-2024-34089 · Vendor Advisory
• https://archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34089 · Security Note
• https://t.me/cvenotify/79293 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1787551454485422590 · Twitter Post
• https://twitter.com/CVEnew/status/1787561505975935046 · Twitter Post
• https://t.me/cvenotify/79250 · Telegram Post
• https://archerirm.com · Note
• https://t.me/cvenotify/115209 · Telegram Post