VulnerabilityModified
CVE-2018-11059
RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability.
MEDIUM 5.4EPSS 1.36%
Does this matter?
Lower severity and a low EPSS score (1.36%). Track it; it rarely justifies an emergency change on its own.
Description
RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.
- CVSS 3.0
- 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.36% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- rsa/archer
- Source
- security_alert@emc.com
References
- http://seclists.org/fulldisclosure/2018/Jul/69Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/104892Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041359Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2018/Jul/69Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/104892Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041359Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.