Lucene search

IBMB9165C7FE0278FFEDDC242DDEC8D014222A6B8ED89F6EB58C198BDBD1E448112

HistoryOct 06, 2022 - 4:10 a.m.

Security Bulletin: IBM Robotic Process Automation is vulnerable to man in the middle attacks through manipulation of client proxy (CVE-2022-36774)

2022-10-0604:10:57

www.ibm.com

ibm robotic process automation

vulnerability

man in the middle

client proxy

security

fix

update

instructions

5.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

0.0004 Low

EPSS

Percentile

12.7%

JSON

Summary

IBM Robotic Process automation is vulnerable to man in the middle attacks through manipulation of the client proxy configuration.

Vulnerability Details

CVEID:CVE-2022-36774
**DESCRIPTION:**IBM Robotic Process automation is vulnerable to man in the middle attacks through manipulation of the client proxy configuration.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/233575 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Robotic Process Automation	< 21.0.3
IBM Robotic Process Automation for Cloud Pak	< 21.0.3
IBM Robotic Process Automation as a Service	< 21.0.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Robotic Process Automation	< 21.0.3	Download 21.0.3 or higher, and follow instructions.
IBM Robotic Process Automation for Cloud Pak	< 21.0.3	Update to 21.0.3 or higher, follow instructions.
IBM Robotic Process Automation as a Service	< 21.0.3	Update client to 21.0.3 or higher, follow instructions.

Workarounds and Mitigations

None.

Affected configurations

Vulners

Node

ibmrobotic_process_automationMatch21.0.0

ibmrobotic_process_automationMatch21.0.1

ibmrobotic_process_automationMatch21.0.2

CPENameOperatorVersion
ibm robotic process automationeq21.0.0
ibm robotic process automationeq21.0.1
ibm robotic process automationeq21.0.2

Name	Operator	Version
ibm robotic process automation	eq	21.0.0
ibm robotic process automation	eq	21.0.1
ibm robotic process automation	eq	21.0.2

5.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for B9165C7FE0278FFEDDC242DDEC8D014222A6B8ED89F6EB58C198BDBD1E448112