CVE-2020-29537
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged...
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
- Record
CVE-2020-29537- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R - Updated
- 2026-11-02
EUVDEUVD-2020-21903
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
- Record
EUVD-2020-21903- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g985-xxfj-53g5 No score
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged...
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
- Record
GHSA-g985-xxfj-53g5- Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
- Record
CVE-2020-29537- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-29537 is a medium vulnerability (CVSS 4.6) in Rsa Archer, published January 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.