Medium severity · published Jan 29, 2021
CVE-2020-29537
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archer · Rsa
6.6 before 6.6.0.8; 6.7 before 6.7.0.8; 6.8 before 6.8.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29537
Vendor Advisory
https://community.rsa.com/docs/DOC-115223
Vendor Advisory
https://www.rsa.com/en-us/company/vulnerability-response-policy
More from Archer
9.8
CVE-2019-3758
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability
8.8
CVE-2022-30584
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users…
8.8
CVE-2020-5335
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability
8.8
CVE-2018-11060
RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API
7.5
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type