« Volver al listado

CVE-2018-11065

Estado: ModificadaMedia (4.3)—

The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to read certain data. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

RSA — Archer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-11065",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell EMC",
          "product": "RSA Archer",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.x,6.2.x"
            },
            {
              "status": "affected",
              "version": "6.3.x",
              "lessThan": "6.3.0.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.4.x",
              "lessThan": "6.4.0.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-24T15:29:00.497",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2018/Aug/31",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105128",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1041540",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2018/Aug/31",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/105128",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1041540",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to read certain data. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability."
    },
    {
      "lang": "es",
      "value": "El componente WorkPoint que está embebido en RSA Archer, en versiones 6.1.x, 6.2.x, 6.3.x anteriores a la 6.3.0.7 y 6.4.x anteriores a la 6.4.0.1, contiene una vulnerabilidad de inyección SQL. Un usuario malicioso podría explotar esta vulnerabilidad para ejecutar comandos SQL en la base de datos del backend para leer ciertos datos. El WorkPoint embebido se ha actualizado a la versión 4.10.16, que contiene una solución para la vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T01:35:11.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C92052E9-4E4A-4E90-8F32-CF15B9143C54",
              "versionEndExcluding": "6.1.0.3",
              "versionStartIncluding": "6.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E833FC3F-F1A5-456F-BE9C-B6D72C37A236",
              "versionEndExcluding": "6.2.0.10",
              "versionStartIncluding": "6.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99D4D067-E6C3-4CC8-BCA2-74DB301A4FDC",
              "versionEndExcluding": "6.3.0.7",
              "versionStartIncluding": "6.3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rsa:archer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8955D404-92B2-4EBF-83D1-333457B8E86B",
              "versionEndExcluding": "6.4.0.1",
              "versionStartIncluding": "6.4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}