Security Bulletin: Passwords are unencrypted locally in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1877)

Summary

IBM Robotic Process Automation could store highly sensitive information in the form of unencrypted passwords that would be available to a local user.

Vulnerability Details

CVEID: CVE-2018-1877 DESCRIPTION: IBM Robotic Process Automation could store highly sensitive information in the form of unencrypted passwords that would be available to a local user.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151713&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

The recommended solution is to apply the interim fix containing APAR JR60078 as soon as practical:

• IBM Robotic Process Automation with Automation Anywhere v11.0
  Product |VRMF|APAR|Remediation / First Fix
  —|—|—|—
  IBM Robotic Process Automation with Automation Anywhere | 11.0.0.1 | JR60078 | IBM Robotic Process Automation with Automation Anywhere v11.0.0.2

Workarounds and Mitigations

None