CVE-2021-38362

In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.

• CWE-639

• https://github.com/fireeye/Vulnerability-DisclosuresThird Party Advisory
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.mdThird Party Advisory
• https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497Third Party Advisory
• https://github.com/fireeye/Vulnerability-DisclosuresThird Party Advisory
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.mdThird Party Advisory
• https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497Third Party Advisory

Published

Mar 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38357The SMS OVH WordPress plugin is vulnerable to Reflected Cros…6.1
• CVE-2021-38358The MoolaMojo WordPress plugin is vulnerable to Reflected Cr…6.1
• CVE-2021-38359The WordPress InviteBox Plugin for viral Refer-a-Friend Prom…6.1
• CVE-2021-3836dbeaver is vulnerable to Improper Restriction of XML Externa…5.5
• CVE-2021-38360The wp-publications WordPress plugin is vulnerable to restri…9.8
• CVE-2021-38361The .htaccess Redirect WordPress plugin is vulnerable to Ref…6.1
• CVE-2021-38363An issue was discovered in ONOS 2.5.1. In IntentManager, the…7.5
• CVE-2021-38364An issue was discovered in ONOS 2.5.1. There is an incorrect…6.5
• CVE-2021-38365Winner (aka ToneWinner) desktop speakers through 2021-08-09 …3.7
• CVE-2021-38366Sitecore through 10.1, when Update Center is enabled, allows…8.8
• CVE-2021-3837openwhyd is vulnerable to Improper Authorization6.1
• CVE-2021-38370In Alpine before 2.25, untagged responses from an IMAP serve…5.9