CVE-2022-30585

The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to view sensitive information. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.archerirm.community/t5/releases/tkb-p/releases	Release Notes Vendor Advisory
https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341	Vendor Advisory
https://www.archerirm.community/t5/releases/tkb-p/releases	Release Notes Vendor Advisory
https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rsa:archer::::::::
	cpe:2.3:a:rsa:archer::::::::

History

21 Nov 2024, 07:02

Type	Values Removed	Values Added
References	~~() https://www.archerirm.community/t5/releases/tkb-p/releases - Release Notes, Vendor Advisory~~	() https://www.archerirm.community/t5/releases/tkb-p/releases - Release Notes, Vendor Advisory
References	~~() https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341 - Vendor Advisory~~	() https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341 - Vendor Advisory

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-863~~	NVD-CWE-noinfo

Information

Published : 2022-05-26 20:15

Updated : 2024-11-21 07:02

NVD link : CVE-2022-30585

Mitre link : CVE-2022-30585

CVE.ORG link : CVE-2022-30585

JSON object : View

Products Affected

rsa

archer

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-30585", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-05-26T20:15:10.420", "references": [{"url": "https://www.archerirm.community/t5/releases/tkb-p/releases", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.archerirm.community/t5/releases/tkb-p/releases", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/677341", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to view sensitive information. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases."}, {"lang": "es", "value": "La API REST en Archer Platform versiones 6.x anteriores a 6.11 (6.11.0.0) contiene una vulnerabilidad de Omisi\u00f3n de Autorizaci\u00f3n. Un usuario malicioso autenticado de forma remota podr\u00eda explotar esta vulnerabilidad para ver informaci\u00f3n confidencial. Las versiones 6.10 P3 (6.10.0.3) y 6.9 SP3 P4 (6.9.3.4) tambi\u00e9n est\u00e1n corregidas"}], "lastModified": "2024-11-21T07:02:58.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "429FCBC1-7176-4FC2-A341-AEE96C74DF38", "versionEndExcluding": "6.9.3.4", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBDEB7C9-7D9A-4D40-97A0-209E1969F755", "versionEndExcluding": "6.10.0.3", "versionStartIncluding": "6.10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}