Medium severity · published Aug 25, 2022
CVE-2022-37318
Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archer · Rsa
6.9.2.2 before 6.10.0.4; 6.11 before 6.11.0.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37318
Product
https://archerirm.com
Vendor Advisory
https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060
More from Archer
9.8
CVE-2019-3758
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability
8.8
CVE-2022-30584
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users…
8.8
CVE-2020-5335
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability
8.8
CVE-2018-11060
RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API
7.5
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type