// For flags

CVE-2018-11059

 

Severity Score

5.4
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

RSA Archer, en versiones anteriores a la 6.4.0.1, contiene una vulnerabilidad de Cross-Site Scripting (XSS) persistente. Un usuario autenticado remoto malicioso de Archer podría explotar esta vulnerabilidad para almacenar código HTML o JavaScript malicioso en un almacén de datos de aplicación de confianza. Cuando los usuarios de la aplicación acceden al almacén de datos corrupto a través de sus navegadores, el código malicioso se ejecuta en el navegador web en el contexto de la aplicación web vulnerable.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-14 CVE Reserved
  • 2018-07-20 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rsa
Search vendor "Rsa"
 Archer
Search vendor "Rsa" for product "Archer"
 >= 6.1.0.0 < 6.1.0.3
Search vendor "Rsa" for product "Archer" and version " >= 6.1.0.0 < 6.1.0.3"
-
Affected
Rsa
Search vendor "Rsa"
 Archer
Search vendor "Rsa" for product "Archer"
 >= 6.2.0.0 < 6.2.0.10
Search vendor "Rsa" for product "Archer" and version " >= 6.2.0.0 < 6.2.0.10"
-
Affected
Rsa
Search vendor "Rsa"
 Archer
Search vendor "Rsa" for product "Archer"
 >= 6.3.0.0 < 6.3.0.7
Search vendor "Rsa" for product "Archer" and version " >= 6.3.0.0 < 6.3.0.7"
-
Affected
Rsa
Search vendor "Rsa"
 Archer
Search vendor "Rsa" for product "Archer"
 6.4.0.0
Search vendor "Rsa" for product "Archer" and version "6.4.0.0"
-
Affected