IBM Robotic Process Automation information disclosure
CVE-2023-22863

5.9MEDIUM

Key Information:

Vendor
IBM
Status
Robotic Process Automation
Vendor
CVE Published:
18 January 2023

Summary

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.

Affected Version(s)

Robotic Process Automation 20.12.0 < 21.0.2

References

https://www.ibm.com/support/pages/node/6855837
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/244109
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.