CVE-2024-26313: archerirm archer

csirt@kutim:~/threat-intel/cve/CVE-2024-26313

CVSS 5.4 · Medium EPSS 0,51%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada archerirm archer. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.13.P3 HF1 (6.13.0.3.1) is also a fixed release.

Rincian

Terbit di NVD: 8 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,51% peluang dieksploitasi; lebih tinggi dari 41,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
archerirm	archer	Semua versi sebelum 6.13.0.3.1
archerirm	archer	Versi 6.14.0 hingga sebelum 6.14.0.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/7171... advisory vendor
https://archerirm.com product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.