exploitDog

CVE-2017-14370

Опубликовано: 11 окт. 2017

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.

Ссылки

http://seclists.org/fulldisclosure/2017/Oct/12
Mailing List
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039518
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2017/Oct/12
Mailing List
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039518
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:rsa:archer_grc_platform:*:*:*:*:*:*:*:*

Версия до 6.2.0.4 (включая)

EPSS

Процентиль: 51%

0.0028

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-g8wr-p6f5-frrv

CVSS3: 5.4

github

больше 3 лет назад

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.

EPSS

Процентиль: 51%

0.0028

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79