CVE-2023-48641

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

0.48%

Published

Dec 12, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass authorization checks, in order to gain execute access to AWF application resources.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-639CWE-639

Affected Products (2)

archerirm · archer (up to 6.14.0.1.2)vulnerable

archerirm · archer (up to 6.13.0.3)vulnerable

References (2)

https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859

Vendor Advisory

https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs