CVE-2019-3716 Information Exposure Vulnerability
An authenticated local user can read the database password from log files, potentially leading to further unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3716?
CVE-2019-3716 is a high-severity vulnerability in Dell RSA Archer, published on 13 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.
Weakness: CWE-532
Which versions are affected by CVE-2019-3716?
It affects 1 product.
Products include Rsa Archer Grc Platform.
How do I fix CVE-2019-3716?
No fix has been published for CVE-2019-3716 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3716 being exploited?
There is no known exploitation of CVE-2019-3716 in the wild and no public exploit code.
Other vulnerabilities in Dell RSA Archer
- CVE-2019-3715 Information Exposure Vulnerability
- CVE-2017-14371 Cross-site scripting in RSA Archer GRC Platform prior to 6.2.0.5
- CVE-2017-14372 Cross-site scripting in RSA Archer GRC Platform prior to 6.2.0.5
- CVE-2017-14370 Cross-site scripting in RSA Archer GRC Platform versions prior to 6.2.0.5
- CVE-2018-15780 DSA-2018-224: RSA Archer GRC Platform Improper Access Control Vulnerability
Sources
Also known as GHSA-fcpf-28p8-7vxv.