CVE-2022-37318

{"id": "CVE-2022-37318", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.2}]}, "published": "2022-08-25T23:15:08.557", "references": [{"url": "https://archerirm.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases."}, {"lang": "es", "value": "Archer Platform versiones 6.9 SP2 P2 anteriores a 6.11 P3 (6.11.0.3) contiene una vulnerabilidad de tipo XSS reflejado. Un usuario remoto no autenticado de Archer podr\u00eda explotar esta vulnerabilidad al enga\u00f1ar a un usuario de la aplicaci\u00f3n v\u00edctima para que suministre c\u00f3digo JavaScript malicioso a la aplicaci\u00f3n web vulnerable. Este c\u00f3digo es reflejado en la v\u00edctima y es ejecutado por el navegador web en el contexto de la aplicaci\u00f3n web vulnerable. Las versiones 6.10 P4 (6.10.0.4) y 6.11 P2 HF4 (6.11.0.2.4) tambi\u00e9n son versiones corregidas."}], "lastModified": "2022-08-29T17:43:39.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45DBF817-644E-43B0-8215-0875C38838F4", "versionEndExcluding": "6.10.0.4", "versionStartIncluding": "6.9.2.2"}, {"criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBDF16C1-7A93-4184-A7AD-7F8787D9BD5C", "versionEndExcluding": "6.11.0.2.4", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}