PT-2024-25699 · Rsa · Archer Platform

Published 2024-05-06 · Updated 2024-07-03 · CVE-2024-34091

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R

Name of the Vulnerable Software and Affected Versions Archer Platform versions prior to 2024.04 Archer Platform version 6.14.0.3 is a fixed release, implying versions prior to 6.14.0.3 are also vulnerable, but since 6.14.0.3 is mentioned as a fixed release and it is part of the versions prior to 2024.04, we focus on the broader range for simplicity.

Description A stored cross-site scripting (XSS) issue allows a remote authenticated malicious user to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed, potentially rendering content inaccessible. This issue can be exploited by a malicious Archer user to affect other users of the application.

Recommendations For Archer Platform versions prior to 2024.04, update to version 6.14.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the data store or implementing additional validation and sanitization of user-inputted data to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34091

Affected Products

Archer Platform

References · 8

• https://archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34091 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34091 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1787551960830218527 · Twitter Post
• https://t.me/cvenotify/79295 · Telegram Post
• https://archerirm.com · Note
• https://twitter.com/CVEnew/status/1787561508291190840 · Twitter Post
• https://t.me/cvenotify/79252 · Telegram Post