CVE-2025-27893: Medium severity Archer Archer Platform vulnerability
In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported exploitation steps and found that, although the user can modify the immutable field, upon switching to View mode the field is reverted to its original value, without anything being saved to the database (and consequently there is no impact).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27893?
CVE-2025-27893 has a high severity level due to the potential for unauthorized modification of immutable fields by authenticated users.
How do I fix CVE-2025-27893?
To fix CVE-2025-27893, apply the latest security updates provided by Archer for versions up to 6.14.00202.10024.
Who is affected by CVE-2025-27893?
CVE-2025-27893 affects users of the Archer Platform versions 6.0 to 6.14.00202.10024 who have record creation privileges.
What are the consequences of exploiting CVE-2025-27893?
Exploiting CVE-2025-27893 could allow an attacker to alter system-generated fields, potentially leading to data integrity issues.
Is there a way to mitigate CVE-2025-27893?
Mitigation strategies for CVE-2025-27893 include restricting user permissions and closely monitoring user actions related to record creation.