You are here

V-234: EMC RSA Archer GRC Open Redirection Weakness and Security Bypass Security Issue

September 4, 2013 - 6:00am

Addthis

PROBLEM:

A weakness and a security issue have been reported in EMC RSA Archer GRC

PLATFORM:

EMC RSA Archer GRC 5.x

ABSTRACT:

This fixes multiple vulnerabilities, which can be exploited to bypass certain security restrictions and to conduct spoofing attacks

REFERENCE LINKS:

Secunia Advisory SA54717
SecurityTracker Alert ID 1028971
EMC Identifier: ESA-2013-057 
CVE-2013-3276
CVE-2013-3277

IMPACT ASSESSMENT:

Medium

DISCUSSION:

1) The application does not properly restrict deactivated users. This can be exploited by deactivated users to login and gain access to otherwise restricted functionality.

2) Certain input is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

IMPACT:

Security Bypass
Spoofing

SOLUTION:

Vendor recommends updating to version 5.4

Addthis