Loading
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.
Use Rsa vendor hub and Archer product page to widen CVE-2021-41594 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2022-30584, CVE-2022-37317 and CVE-2021-33615 for nearby disclosures in the same product family.