Lucene search

IBM54BE7E68E03BCA960301F14F051EF595B5F410B9034C9AD7BCCB15BE134C91BB

HistoryJun 16, 2022 - 9:47 p.m.

Security Bulletin: IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids (CVE-2022-30607)

2022-06-1621:47:34

www.ibm.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

34.8%

JSON

Summary

IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids (CVE-2022-30607)

Vulnerability Details

CVEID:CVE-2022-30607
**DESCRIPTION:**IBM Robotic Process Automation contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI.
CVSS Base score: 2.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Robotic Process Automation	21.0.2
IBM Robotic Process Automation for Cloud Pak	21.0.2

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s)	Version(s)	Remediation/Fix/Instructions
IBM Robotic Process Automation	< 21.0.2.3	Download and apply 21.0.2 IF003 or higher.
IBM Robotic Process Automation for Cloud Pak	< 21.0.2.3	Apply 21.0.2 IF003 or higher.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrobotic_process_automationMatch20.10.0

ibmrobotic_process_automationMatch20.12.5

ibmrobotic_process_automationMatch21.0.0

ibmrobotic_process_automationMatch21.0.1

ibmrobotic_process_automationMatch21.0.2

CPENameOperatorVersion
ibm robotic process automationeq20.10.0
ibm robotic process automationeq20.12.5
ibm robotic process automationeq21.0.0
ibm robotic process automationeq21.0.1
ibm robotic process automationeq21.0.2

Name	Operator	Version
ibm robotic process automation	eq	20.10.0
ibm robotic process automation	eq	20.12.5
ibm robotic process automation	eq	21.0.0
ibm robotic process automation	eq	21.0.1
ibm robotic process automation	eq	21.0.2

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

34.8%

JSON

Related for 54BE7E68E03BCA960301F14F051EF595B5F410B9034C9AD7BCCB15BE134C91BB