CVE-2021-41594

Опубликовано: 30 мар. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.

Ссылки

https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497
Third Party Advisory
https://www.rsa.com/en-us/company/vulnerability-response-policy
Vendor Advisory
https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497
Third Party Advisory
https://www.rsa.com/en-us/company/vulnerability-response-policy
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*

Версия от 6.1.0.0 (включая) до 6.9.3.3 (исключая)

EPSS

Процентиль: 48%

0.00247

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-pc9r-vxv3-8rvc