CVE-2021-29253 : Security Advisory and Response
Learn about CVE-2021-29253 impacting RSA Archer versions 6.4 P1 through 6.9 P2. Find out the risks, impact, affected systems, and mitigation steps to secure your organization.
A detailed analysis of CVE-2021-29253, an insecure credential storage vulnerability affecting the Tableau integration in RSA Archer versions 6.4 P1 through 6.9 P2.
Understanding CVE-2021-29253
Insecure credential storage vulnerability in RSA Archer.
What is CVE-2021-29253?
The Tableau integration in RSA Archer versions 6.4 P1 through 6.9 P2 is impacted by an insecure credential storage vulnerability. This vulnerability allows a malicious attacker with Tableau workbook file access to obtain credential information for potential misuse.
The Impact of CVE-2021-29253
With a CVSS base score of 5.1, classified as MEDIUM severity, this vulnerability poses a high confidentiality impact. Attackers can leverage this vulnerability to access sensitive credentials, potentially leading to further security breaches.
Technical Details of CVE-2021-29253
Understanding the vulnerability, affected systems, and exploitation mechanism.
Vulnerability Description
The vulnerability arises due to insecure storage of credentials within the Tableau integration in vulnerable RSA Archer versions. Attackers with workbook access can exploit this weakness.
Affected Systems and Versions
RSA Archer versions 6.4 P1 through 6.9 P2 are affected by this vulnerability, exposing them to potential credential exposure.
Exploitation Mechanism
Malicious actors with access to the vulnerable Tableau workbook file can extract credential information, bypassing security protocols.
Mitigation and Prevention
Guidelines for securing systems against CVE-2021-29253.
Immediate Steps to Take
Organizations are advised to restrict access to Tableau workbook files, regularly monitor for unauthorized access, and apply security patches promptly.
Long-Term Security Practices
Implement strict credential management policies, conduct regular security audits, and educate users on secure data handling practices.
Patching and Updates
Ensure timely installation of security patches released by RSA Archer to address the vulnerable credential storage issue.