EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability.

Published 9 y ago 2017-07-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.1%

percentile 67%

Public exploits

none known

EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the RSA Archer application without the victims realizing an attack occurred.

Exploit prediction (EPSS)

1.15% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`

Affected products

n/a RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

securityfocus.com /bid/99354 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1038815 · vdb-entry, x_refsource_SECTRACK, x_transferred
seclists.org /fulldisclosure/2017/Jun/49 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-5002
NVD: CVE-2017-5002

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.