CVE-2016-0899

Severity: medium (CVSS 6.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-04 · updated 2026-06-17
Weakness: CWE-200

Description

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files.

Affected products

RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1: 5.5, 5.5-sp1, 5.5.1, 5.5.1.3, 5.5.2.3

References

http://seclists.org/bugtraq/2016/Jun/54
http://www.securitytracker.com/id/1036080
http://seclists.org/bugtraq/2016/Jun/54
http://www.securitytracker.com/id/1036080

Get alerted when CVE-2016-0899 or the next vulnerability affects your stack