Lucene search

K
ibmIBMCDCFB4663601A4F092C7E903C70C0A3701458EE6E6D1FCE0381C11891DF71EE3
HistoryNov 01, 2023 - 9:19 p.m.

Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in access to client vault credentials (CVE-2023-45189).

2023-11-0121:19:10
www.ibm.com
14
ibm robotic process automation
vulnerability
access
client vault credentials
cve-2023-45189
low privileged attacker
programmatically
cloud pak
versions
remediation
update
instructions

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

Summary

A vulnerability in IBM Robotic Process Automation may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials.

Vulnerability Details

CVEID:CVE-2023-45189
**DESCRIPTION:**A vulnerability in IBM Robotic Process Automation may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268752 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Robotic Process Automation for Cloud Pak 21.0.0 - 21.0.7.10, 23.0.0 - 23.0.10
IBM Robotic Process Automation 21.0.0 - 21.0.7.10, 23.0.0 - 23.0.10

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s) **Version(s) number and/or range ** Remediation/Fix/Instructions
IBM Robotic Process Automation 21.0.0 - 21.0.7.10 Download 21.0.7.11 or higher and follow these instructions.
IBM Robotic Process Automation for Cloud Pak 21.0.0 - 21.0.7.10 Update to 21.0.7.11 or higher using the following instructions.
IBM Robotic Process Automation 23.0.0 - 23.0.10 Download 23.0.11 or higher and follow these instructions.

IBM Robotic Process Automation for Cloud Pak

| 23.0.0 - 23.0.10| Update to 23.0.11 or higher using the following instructions.

Workarounds and Mitigations

None.

Affected configurations

Vulners
Node
ibmrobotic_process_automationMatch21.0.0
OR
ibmrobotic_process_automationMatch21.0.7.10
OR
ibmrobotic_process_automationMatch23.0.0
OR
ibmrobotic_process_automationMatch23.0.10

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

Related for CDCFB4663601A4F092C7E903C70C0A3701458EE6E6D1FCE0381C11891DF71EE3