[FD] DSA-2018-130: RSA Archer® Multiple Vulnerabilities

[Dell EMC Product Security Response Center <Security_Alert@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

DSA-2018-130: RSA Archer® Multiple Vulnerabilities

Dell EMC Identifier: DSA-2018-130

CVE Identifier: CVE-2018-11059, CVE-2018-11060

Severity Rating: See below for scores of individual CVEs

Severity: High

Affected Products:

RSA Archer version 6.4
RSA Archer versions 6.3.x
RSA Archer versions 6.2.x
RSA Archer versions 6.1.x
 

Summary: 

RSA Archer has fixes available for multiple security vulnerabilities that could 
potentially be exploited by malicious users to compromise the affected system.


Details: 

RSA Archer product has been updated to address the following vulnerabilities:

 

Stored Cross-Site Scripting Vulnerability (CVE-2018-11059)
 

RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting 
vulnerability. A remote authenticated malicious Archer user could potentially 
exploit this vulnerability to store malicious HTML or JavaScript code in a 
trusted application data store. When application users access the corrupted 
data store through their browsers, the malicious code gets executed by the web 
browser in the context of the vulnerable web application.
CVSSv3 Base Score: 8.2 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L)

 

REST API Authorization Bypass Vulnerability (CVE-2018-11060)


RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass 
vulnerability in the REST API. A remote authenticated malicious Archer user 
could potentially exploit this vulnerability to elevate their privileges.
CVSSv3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

 

Recommendation:

For CVE-2018-11059, the following RSA Archer releases contain a resolution for 
this vulnerability: 

RSA Archer version 6.4.0.1
RSA Archer version 6.3.0.7
 

For CVE-2018-11060, the following RSA Archer releases contain a resolution for 
this vulnerability:

RSA Archer version 6.4.0.1
RSA Archer version 6.3.0.7
RSA Archer version 6.2.0.10
RSA Archer version 6.1.0.3 
 

RSA recommends all customers upgrade at the earliest opportunity.


Credit: Dell EMC would like to thank Francesca Perrone and Donato Onofri of 
Business Integration Partners for reporting CVE-2018-11059.


For additional documentation, downloads, and more, visit the RSA Archer Suite 
page on RSA Link.

 
EOPS Policy:

RSA has a defined End of Primary Support policy associated with all major 
versions. Please refer to the Product Version Life Cycle for additional details.

Severity Rating

For an explanation of Severity Ratings, refer to the Security Advisories 
Severity Rating (https://community.rsa.com/docs/DOC-47147) knowledge base 
article. RSA recommends all customers take into account both the base score and 
any relevant temporal and environmental scores which may impact the potential 
severity associated with particular security vulnerability.


Legal Information

Read and use the information in this RSA Security Advisory to assist in 
avoiding any situation that might arise from the problems described herein. If 
you have any questions regarding this advisory, contact RSA Technical Support 
(https://community.rsa.com/docs/DOC-1294). RSA Security LLC and its affiliates, 
including without limitation, its ultimate parent company, Dell Technologies, 
distribute RSA Security Advisories in order to bring to the attention of users 
of the affected RSA products, important security information. RSA recommends 
that all users determine the applicability of this information to their 
individual situations and take appropriate action. The information set forth 
herein is provided "as is" without warranty of any kind. RSA disclaims all 
warranties, either express or implied, including the warranties of 
merchantability, fitness for a particular purpose, title and non-infringement. 
In no event shall RSA, its affiliates or its suppliers, be liable for any 
damages whatsoever including direct, indirect, incidental, consequential, loss 
of business profits or special damages, even if RSA, its affiliates or its 
suppliers have been advised of the possibility of such damages. Some 
jurisdictions do not allow the exclusion or limitation of liability for 
consequential or incidental damages, so the foregoing limitation may not apply.



Dell EMC Product Security Response Center

security_alert@xxxxxxx

http://www.emc.com/products/security/product-security-response-center.htm

 
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEazKDH3UU9DEtTDc5dty75+wTzVkFAltPT7AACgkQdty75+wT
zVm3cwf+NfKVYftBQifTKu2ioke9xESGIt6m0ra2kDEOX8ZtFeohbEUU8IdjNgUw
ORd39KfrAEdE5STmtbmevRnEx+//kzWH8LpCXnw/YLsoeaTMGejtNhxMNtpxVq7k
2NFHEM9yMTVwPso53OsFrQYYrdADMBzPIvLhyKqSCgTu5Lz0+Zo/DaFt37XCk1bu
w8Nhoi5vruiUdR/VE4nMASn2Gy3mMVK4Au+Wh8X3U1/gHVRtRAY6JCBjYHtuyIno
RLAyShBlSLKMH+2lplAJ0P66yQen7LNX0A4nDn59GriAzV3skHvKnUb/hrA6+rME
gIeZ3zZAVIxr27BFxAhOSFvRcqQw3Q==
=xZUV
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/