Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and may result in a bypass of security restrictions (CVE-2024-28849)

Summary

A vulnerability in axios affects IBM Robotic Process Automation resulting in a bypass of security restrictions. axios is used by IBM Robotic Process Automation as part of the Control Center. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2024-28849
**DESCRIPTION:**Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by the leakage of credentials when clearing authorization header during cross-domain redirect, but keeping the proxy-authentication header. An attacker could exploit this vulnerability to obtain credentials and other sensitive information.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285690 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

IBM Robotic Process Automation for Cloud Pak

| 23.0.0 - 23.0.15| Update to 23.0.16 or higher using the following instructions.

Workarounds and Mitigations

None