1. Home
  2. CVE Database
  3. CVE-2016-0899
MEDIUM · 6.3

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Cont...

Vulnerability Description

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files.

CVSS Score

6.3

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EmcRsa Archer Egrc5.5

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2016-0899?

CVE-2016-0899 is a vulnerability with a CVSS score of 6.3 (MEDIUM). EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Cont...

How severe is CVE-2016-0899?

CVE-2016-0899 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-0899?

Check the references section above for vendor advisories and patch information. Affected products include: Emc Rsa Archer Egrc.