A vulnerability was found in Dell EMC RSA Archer up to 6.6 P2 (Risk Management System). It has been classified as problematic. This affects an unknown function of the component Backend Database. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.

The weakness was released 09/18/2019. This vulnerability is uniquely identified as CVE-2019-3756 since 01/03/2019. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Applying the patch 6.6 P3 is able to eliminate this problem.

Entry connected to this vulnerability is available at VDB-141982. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Risk Management System

Vendor

• Dell EMC

Name

• RSA Archer

Version

• 6.6 P2

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion