CVE-2024-26311: XSS
First published: Wed Feb 21 2024(Updated: )
Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RSA Archer GRC Platform | <6.14 | |
| RSA Archer | <6.14.0.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26311?
CVE-2024-26311 is classified as a reflected XSS vulnerability that poses a medium risk to affected users.
How do I fix CVE-2024-26311?
To mitigate CVE-2024-26311, upgrade Archer Platform to version 6.14 P2 HF1 (6.14.0.2.1) or later.
Who is affected by CVE-2024-26311?
CVE-2024-26311 affects the RSA Archer Platform versions up to but not including 6.14 P2 HF1.
Can CVE-2024-26311 be exploited remotely?
Yes, CVE-2024-26311 can be exploited remotely by authenticated users who can send crafted malicious scripts.
What kind of attack does CVE-2024-26311 enable?
CVE-2024-26311 enables reflected cross-site scripting (XSS) attacks, allowing attackers to inject JavaScript into the affected application.
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/archerirm
- canonical/rsa archer
- vendor/archer
- canonical/rsa archer grc platform