CVE-2019-3756
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
Published
2019-09-18T23:15:11.237
Last Modified
2024-11-21T04:42:28.283
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 6.5 (MEDIUM)
CVSSv2 Vector
AV:N/AC:L/Au:S/C:P/I:N/A:N
- Access Vector: NETWORK
- Access Complexity: LOW
- Authentication: SINGLE
- Confidentiality Impact: PARTIAL
- Integrity Impact: NONE
- Availability Impact: NONE
Exploitability Score
8.0
Impact Score
2.9
Weaknesses
-
Type: Secondary
CWE-209
-
Type: Primary
CWE-200
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
rsa
|
archer
|
< 6.6.0.3 |
Yes
|
References