CVE ID: The Common Vulnerabilities and Exposures Identifiers (CVE IDs) are listed in the table below.
Issue Summary: This article provides a list of security vulnerabilities that cannot be exploited on Dell EMC RSA Archer 6.4 SP1, but which may be flagged by security scanners.
Link to Advisories: Each CVE ID listed can be searched using the following link:
https://web.nvd.nist.gov/view/vuln/search. Once there, you can search for each CVE ID referenced in this article for more details.
Impact Details: The vulnerabilities listed in the table below are in order by the date on which RSA Archer Engineering determined that RSA Archer 6.4 SP1 was not vulnerable.
| CVE ID | Summary of Vulnerability | Reason Product is Not Vulnerable | Date Determined False Positive |
| CVE-2017-1000048 | ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a denial-of-service (DoS). | Component version used is higher than the impacted version. | June 13, 2018 |
| CVE-2018-1270 | Spring Framework is vulnerable to remote code execution (RCE) due to lack of proper validation of user-supplied input. | GemFire caching does not leverage the vulnerable component. | June 13, 2018 |
| CVE-2018-1271 | Spring Framework is vulnerable to directory traversal due to the way static content can be loaded. | GemFire does not serve files from the file system. | June 19, 2018 |
| CVE-2018-1272 | Spring Framework is vulnerable to privilege escalation due to insufficient validation of user-supplied input. | GemFire caching does not leverage the vulnerable component. | June 17, 2018 |
| CVE-2018-1273 | Spring Data Commons contain a property binder vulnerability caused by improper neutralization of special elements. | GemFire is not shipped with the vulnerable component. | June 29, 2018 |
| CVE-2018-1274 | Spring Data Commons is vulnerable to denial-of-service (DoS) because it does not check for lengthy path names. | GemFire is not shipped with the vulnerable component. | June 29, 2018 |
CVE-2015-9251
| Library is vulnerable to cross-site scripting (XSS) attack caused by a lack of user input sanitization. | Local help system is not leveraged by web server component involving user session and user input. | July 5, 2018 |
