CVE-2019-3715: Information Exposure Vulnerability

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-13 · updated 2026-06-17
Weakness: CWE-532

Description

RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.

Affected products

RSA Archer GRC Platform prior to 6.2.0.5: before 6.5; 6.5 — fixed in 6.5

How to fix

Upgrade to a fixed version: RSA Archer GRC Platform prior to 6.2.0.5 6.5. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/107443
https://seclists.org/fulldisclosure/2019/Mar/19
http://www.securityfocus.com/bid/107443
https://seclists.org/fulldisclosure/2019/Mar/19

Get alerted when CVE-2019-3715 or the next vulnerability affects your stack