Lucene search

IBM868B626BC3013B5DE177748DE0C424A5C56B93A54156AAFDA8B5C5DC79EB1670

HistoryJun 21, 2023 - 10:06 p.m.

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to insufficient security configuration (CVE-2023-23468).

2023-06-2122:06:39

www.ibm.com

ibm

rpa

cloud pak

vulnerability

security configuration

namespace creation

cve-2023-23468

security fixes

update

instructions

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Summary

IBM Robotic Process Automation for Cloud Pak is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster (CVE-2023-23468). This bulletin identifies the security fixes to apply to address this vulnerability.

Vulnerability Details

CVEID:CVE-2023-23468
**DESCRIPTION:**IBM Robotic Process Automation for Cloud Pak is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/244500 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Robotic Process Automation for Cloud Pak	21.0.1-21.0.7.3, 23.0.0 - 23.0.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Robotic Process Automation for Cloud Pak	21.0.1 - 21.0.7.3	Update to 21.0.7.4 or higher using the following instructions.
IBM Robotic Process Automation for Cloud Pak	23.0.0 - 23.0.3	Update to 23.0.4 or higher using the following instructions.

Workarounds and Mitigations

None.

Affected configurations

Vulners

Node

ibmrobotic_process_automationMatch21.0.1

ibmrobotic_process_automationMatch21.0.7.3

ibmrobotic_process_automationMatch23.0.0

ibmrobotic_process_automationMatch23.0.3

CPENameOperatorVersion
ibm robotic process automationeq21.0.1
ibm robotic process automationeq21.0.7.3
ibm robotic process automationeq23.0.0
ibm robotic process automationeq23.0.3

Name	Operator	Version
ibm robotic process automation	eq	21.0.1
ibm robotic process automation	eq	21.0.7.3
ibm robotic process automation	eq	23.0.0
ibm robotic process automation	eq	23.0.3

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for 868B626BC3013B5DE177748DE0C424A5C56B93A54156AAFDA8B5C5DC79EB1670