CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48641
https://notcve.org/view.php?id=CVE-2023-48641
Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass authorization checks, in order to gain execute access to AWF application resources. Archer Platform 6.x anterior a 6.14 P1 HF2 (6.14.0.1.2) contiene una vulnerabilidad de referencia directa a objeto insegura. Un usuario malintencionado autenticado en una instalación de múltiples instancias podría explotar esta vulnerabilidad manipulando las referencias de recursos de la aplicación en las solicitudes de los usuarios para eludir las comprobaciones de autorización, con el fin de obtener acceso de ejecución a los recursos de la aplicación AWF. • https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48642
https://notcve.org/view.php?id=CVE-2023-48642
Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release. Archer Platform 6.x anterior a 6.13 P2 (6.13.0.2) contiene una vulnerabilidad de inyección de contenido HTML autenticado. Un usuario malicioso de Archer autenticado remotamente podría explotar esto para almacenar código HTML malicioso en un almacén de datos de aplicaciones confiable. • https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45357
https://notcve.org/view.php?id=CVE-2023-45357
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release. Archer Platform 6.x anterior a 6.13 P2 HF2 (6.13.0.2.2) contiene una vulnerabilidad de divulgación de información confidencial. Un atacante autenticado podría potencialmente obtener acceso a información confidencial a través de un mensaje de advertencia emergente. 6.14 (6.14.0) también es una versión corregida. • https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45358
https://notcve.org/view.php?id=CVE-2023-45358
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release. Archer Platform 6.x anterior a 6.13 P2 HF2 (6.13.0.2.2) contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenada. Un usuario malicioso de Archer autenticado remotamente podría explotar esta vulnerabilidad para almacenar código HTML o JavaScript malicioso en un almacén de datos de aplicaciones confiable. • https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/708617 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37224
https://notcve.org/view.php?id=CVE-2023-37224
An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files. • https://archerirm.com https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362 • CWE-532: Insertion of Sensitive Information into Log File •