Access Control Bypass in RSA Archer by RSA

CVE-2021-41594

Summary

In RSA Archer 6.9.SP1 P3, an access control vulnerability exists that allows an attacker to bypass user permissions. This issue arises when an Administrator restricts certain application functions. An attacker can exploit this by intercepting API requests directed at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. By replacing parameters in the request with empty fields, the attacker gains unauthorized access to restricted functions, potentially compromising sensitive data and operations.

References