CVE-2018-11060

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-24 · updated 2026-06-17

Description

RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to elevate their privileges.

Affected products

Dell RSA Archer: from 6.1.0.0 before 6.1.0.3; from 6.2.0.0 before 6.2.0.10; from 6.3.0.0 before 6.3.0.7; 6.4.0.0 — fixed in 6.1.0.3, 6.2.0.10, 6.3.0.7

How to fix

Upgrade to a fixed version: Dell RSA Archer 6.1.0.3, 6.2.0.10, 6.3.0.7. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2018/Jul/69
http://www.securityfocus.com/bid/104892
http://www.securitytracker.com/id/1041359
http://seclists.org/fulldisclosure/2018/Jul/69
http://www.securityfocus.com/bid/104892
http://www.securitytracker.com/id/1041359

Get alerted when CVE-2018-11060 or the next vulnerability affects your stack