CVE-2021-29252

Published: May 26, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim's browser.

Affected (4)

Products: Rsa: Archer

Rsa

1 product

Archer

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Rsa Archer	From 6.6 to 6.6.0.8
Rsa Archer	From 6.7 to 6.7.0.8
Rsa Archer	From 6.8 to 6.8.0.5
Rsa Archer	From 6.9 to 6.9.1.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://community.rsa.com/t5/archer-product-advisories/rsa-2021-04-archer-an-rsa-business-update-for-multiple/ta-p/603223

Source: cve@mitre.org

Vendor Advisory

https://www.rsa.com/en-us/company/vulnerability-response-policy

Source: cve@mitre.org

Vendor Advisory

https://community.rsa.com/t5/archer-product-advisories/rsa-2021-04-archer-an-rsa-business-update-for-multiple/ta-p/603223

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.rsa.com/en-us/company/vulnerability-response-policy

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.