CVE-2018-15780: DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-03 · updated 2026-06-17

Description

RSA Archer versions prior to 6.5.0.1 contain an improper access control vulnerability. A remote malicious user could potentially exploit this vulnerability to bypass authorization checks and gain read access to restricted user information.

Affected products

RSA Archer GRC Platform prior to 6.2.0.5: before 6.5.0.1 — fixed in 6.5.0.1

How to fix

Upgrade to a fixed version: RSA Archer GRC Platform prior to 6.2.0.5 6.5.0.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106396
https://seclists.org/fulldisclosure/2019/Jan/3
http://www.securityfocus.com/bid/106396
https://seclists.org/fulldisclosure/2019/Jan/3

Get alerted when CVE-2018-15780 or the next vulnerability affects your stack