Medium severity · published May 26, 2021
CVE-2021-29253
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archer · Rsa
6.4 before 6.6.0.8; 6.7 before 6.7.0.8; 6.8 before 6.8.0.5; 6.9 before 6.9.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29253
Vendor Advisory
https://community.rsa.com/t5/archer-product-advisories/rsa-2021-04-archer-an-rsa-business-update-for-multiple/ta-p/603223
Vendor Advisory
https://www.rsa.com/en-us/company/vulnerability-response-policy
More from Archer
9.8
CVE-2019-3758
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability
8.8
CVE-2022-30584
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users…
8.8
CVE-2020-5335
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability
8.8
CVE-2018-11060
RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API
7.5
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type