CVE-2019-3716: Information Exposure Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-13 · updated 2026-06-17
Weakness: CWE-532

Description

RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.

Affected products

RSA Archer GRC Platform prior to 6.2.0.5: before 6.5.2.0 — fixed in 6.5.2.0

How to fix

Upgrade to a fixed version: RSA Archer GRC Platform prior to 6.2.0.5 6.5.2.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/107406
https://seclists.org/fulldisclosure/2019/Mar/19
http://www.securityfocus.com/bid/107406
https://seclists.org/fulldisclosure/2019/Mar/19

Get alerted when CVE-2019-3716 or the next vulnerability affects your stack