Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in exposure of the name and email for the creator/modifier of platform level objects (CVE-2022-43573)

2023-01-0421:07:18

www.ibm.com

ibm rpa

vulnerability

exposure

creator

modifier

cloud pak

version

remediation

instructions

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

27.4%

JSON

Summary

There is a vulnerability in IBM Robotic Process Automation. Accessing specific platform level objects created in RPA may expose the creator or modifiers email address. This bulletin identifies the security fixes to apply to address this vulnerability.

Vulnerability Details

CVEID:CVE-2022-43573
**DESCRIPTION:**IBM Robotic Process Automation is vulnerable to exposure of the name and email for the creator/modifier of platform level objects.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238678 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Robotic Process Automation for Cloud Pak	< 21.0.7
IBM Robotic Process Automation	< 21.0.7
IBM Robotic Process Automation as a Service	< 21.0.7

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Robotic Process Automation	< 21.0.7	Download 21.0.7 and follow instructions.
IBM Robotic Process Automation for Cloud Pak	< 21.0.7	Update to 21.0.7 following these instructions.
IBM Robotic Process Automation as a Service	< 21.0.7	No action required as IBM Robotic Process Automation Servers have been updated.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrobotic_process_automationMatch20.12.

ibmrobotic_process_automationMatch21.0.6

VendorProductVersionCPE
ibmrobotic_process_automation20.12.cpe:2.3:a:ibm:robotic_process_automation:20.12.:*:*:*:*:*:*:*
ibmrobotic_process_automation21.0.6cpe:2.3:a:ibm:robotic_process_automation:21.0.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation	20.12.	cpe:2.3:a:ibm:robotic_process_automation:20.12.:::::::*
ibm	robotic_process_automation	21.0.6	cpe:2.3:a:ibm:robotic_process_automation:21.0.6:::::::*