RSA Archer GRC security vulnerabilities

Invalid login restrictions, open redirect...

ESA-2013-057: RSA Archer(r) GRC Multiple Vulnerabilities

ESA-2013-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-057: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-057 CVE Identifier: CVE-2013-3276, CVE-2013-3277 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RSA Archer versio...

CVE-2013-3276

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3277

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Design/Logic Flaw

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3276

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3277

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-3276

RSA Archer GRC 5.x before 5.4 is affected by CVE-2013-3276: an improper restriction of user login allows remote authenticated users to bypass login by leveraging a deactivated account. The vulnerability (CVSSv2 base score 6.0) impacts authentication, with partial confidentiality, integrity, and a...

CVE-2013-3277

RSA Archer GRC 5.x (pre-5.4) contains an open redirect vulnerability (CVE-2013-3277) that could enable phishing by redirecting users to arbitrary sites. The issue affects EMC RSA Archer GRC platform versions prior to 5.4; downgrade is not indicated. The public advisory ESA-2013-057 notes this vul...

PT-2013-4272

Name of the Vulnerable Software and Affected Versions EMC RSA Archer GRC versions 5.x before 5.4 Description The issue allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account. Recommendations For versions 5.x before 5.4,...

CVE-2013-3276: Undefined Security Weakness

EMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access restrictions and complete a login by leveraging a deactivated account...

CVE-2013-3277: Improper Input Validation

Open redirect vulnerability in EMC RSA Archer GRC 5.x before 5.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2013-4273

Name of the Vulnerable Software and Affected Versions EMC RSA Archer GRC versions prior to 5.4 Description The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. Recommendations For versions prior to 5.4, update to version 5.4 or later...

CVE-2013-0934

EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and modify global reports via unspecified vectors...

CVE-2013-0933

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0932

EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and upload arbitrary files via unspecified vectors...

Design/Logic Flaw

EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and upload arbitrary files via unspecified vectors...

Design/Logic Flaw

EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and modify global reports via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...