CVE-2016-0899: Infoleak

Published Jul 4, 2016

Updated

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files.

Affected Software

5 affected components

EMC Rsa Archer Egrc=5.5

EMC Rsa Archer Egrc=5.5-sp1

EMC Rsa Archer Egrc=5.5.1

EMC Rsa Archer Egrc=5.5.1.3

EMC Rsa Archer Egrc=5.5.2.3

Event History

Jul 4, 2016

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0899?

CVE-2016-0899 is considered a medium severity vulnerability due to its potential exposure of sensitive credential information.

How do I fix CVE-2016-0899?

To fix CVE-2016-0899, upgrade your EMC RSA Archer GRC to version 5.5.3.4 or later.

Who is affected by CVE-2016-0899?

CVE-2016-0899 affects users of EMC RSA Archer GRC versions 5.5.x up to 5.5.3.3, including all specific subversions mentioned.

What kind of data can be exposed due to CVE-2016-0899?

CVE-2016-0899 allows remote authenticated users to read the web.config.bak file, potentially exposing sensitive credential information.

Is there a workaround for CVE-2016-0899?

A temporary workaround for CVE-2016-0899 includes restricting access to the .bak files in the IIS configuration until a proper update can be applied.