Security Bulletin: A vulnerability in go-restful affects IBM Robotic Process Automation for Cloud Pak resulting in a bypass of security restrictions (CVE-2022-1996).

Summary

A vulnerability in go-restful affects IBM Robotic Process Automation for Cloud Pak resulting in a bypass of security restrictions. go-restful is used by IBM Robotic Process Automation for Cloud Pak as part of the operator framework. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2022-1996
**DESCRIPTION:**go-restful could allow a remote attacker to bypass security restrictions, caused by improper regular expression implementation in the CORS Filter feature. By sending a specially-crafted request using the AllowedDomains parameter, an attacker could exploit this vulnerability to break CORS policy and allow any page to make requests.
CVSS Base score: 9.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228317 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s)|**Version(s)
**
—|—
IBM Robotic Process Automation for Cloud Pak| 21.0.0 - 21.0.7.8, 23.0.0 - 23.0.9

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Workarounds and Mitigations

None