CVE-2022-37318

Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://archerirm.com	Product
https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060	Vendor Advisory
https://archerirm.com	Product
https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rsa:archer::::::::
	cpe:2.3:a:rsa:archer::::::::

History

21 Nov 2024, 07:14

Type	Values Removed	Values Added
References	~~() https://archerirm.com - Product~~	() https://archerirm.com - Product
References	~~() https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060 - Vendor Advisory~~	() https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.1~~	v2 : unknown v3 : 7.0

Information

Published : 2022-08-25 23:15

Updated : 2024-11-21 07:14

NVD link : CVE-2022-37318

Mitre link : CVE-2022-37318

CVE.ORG link : CVE-2022-37318

JSON object : View

Products Affected

rsa

archer

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-37318", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-08-25T23:15:08.557", "references": [{"url": "https://archerirm.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://archerirm.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases."}, {"lang": "es", "value": "Archer Platform versiones 6.9 SP2 P2 anteriores a 6.11 P3 (6.11.0.3) contiene una vulnerabilidad de tipo XSS reflejado. Un usuario remoto no autenticado de Archer podr\u00eda explotar esta vulnerabilidad al enga\u00f1ar a un usuario de la aplicaci\u00f3n v\u00edctima para que suministre c\u00f3digo JavaScript malicioso a la aplicaci\u00f3n web vulnerable. Este c\u00f3digo es reflejado en la v\u00edctima y es ejecutado por el navegador web en el contexto de la aplicaci\u00f3n web vulnerable. Las versiones 6.10 P4 (6.10.0.4) y 6.11 P2 HF4 (6.11.0.2.4) tambi\u00e9n son versiones corregidas."}], "lastModified": "2024-11-21T07:14:45.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45DBF817-644E-43B0-8215-0875C38838F4", "versionEndExcluding": "6.10.0.4", "versionStartIncluding": "6.9.2.2"}, {"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBDF16C1-7A93-4184-A7AD-7F8787D9BD5C", "versionEndExcluding": "6.11.0.2.4", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}