CVE-2019-3715
Information Exposure Vulnerability
Severity Score
5.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.
RSA Archer, en CVErsiones anteriores a la 6.5 SP1, contiene una vulnerabilidad de exposición de información. La información de las sesiones de usuario se almacena en texto plano en los archivos de registro de RSA Archer. Un usuario autenticado malicioso con acceso a los archivos de registro podría obtener la información expuesta para emplearla en más ataques.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-01-03 CVE Reserved
- 2019-03-13 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-532: Insertion of Sensitive Information into Log File
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/107443 | Vdb Entry | |
| https://seclists.org/fulldisclosure/2019/Mar/19 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rsa Search vendor "Rsa" | Archer Grc Platform Search vendor "Rsa" for product "Archer Grc Platform" | < 6.5 Search vendor "Rsa" for product "Archer Grc Platform" and version " < 6.5" | - |
Affected
| ||||||
| Rsa Search vendor "Rsa" | Archer Grc Platform Search vendor "Rsa" for product "Archer Grc Platform" | 6.5 Search vendor "Rsa" for product "Archer Grc Platform" and version "6.5" | - |
Affected
| ||||||