What’s Vulnerable › Vulnerabilities

CVE-2021-38362

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-30 · updated 2026-06-17
• Weakness: CWE-639

Description

In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

Affected products

• Dell RSA Archer: from 6.1.0.0 before 6.9.3.0.1 — fixed in 6.9.3.0.1

How to fix

Upgrade to a fixed version: Dell RSA Archer 6.9.3.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/fireeye/Vulnerability-Disclosures
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.md
• https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497
• https://github.com/fireeye/Vulnerability-Disclosures
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.md
• https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497

Get alerted when CVE-2021-38362 or the next vulnerability affects your stack