PT-2024-25700 · Rsa · Archer Platform

Published 2024-05-06 · Updated 2025-03-18 · CVE-2024-34092

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archer Platform versions prior to 2024.04 Archer Platform version 6.14.0.3 is a fixed release, implying versions prior to 6.14.0.3 are also affected, but since 6.14.0.3 is mentioned as a fixed release and is part of the versions prior to 2024.04, we focus on the broader range for simplicity.

Description An issue was discovered in the Archer Platform where authentication was mishandled. This occurred because the lock did not terminate an existing session.

Recommendations For Archer Platform versions prior to 2024.04, update to version 6.14.0.3 or later to resolve the issue. As a temporary workaround, consider implementing additional session termination mechanisms to mitigate the risk of exploitation until a patch is applied.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-34092

Affected Products

Archer Platform

References · 9

• https://archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34092 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34092 · Vendor Advisory
• https://t.me/cvenotify/115166 · Telegram Post
• https://twitter.com/CVEnew/status/1787561509545201819 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787552213885141380 · Twitter Post
• https://archerirm.com · Note
• https://t.me/cvenotify/79296 · Telegram Post
• https://t.me/cvenotify/79253 · Telegram Post