CVE-2022-35280

2022-08-1017:15:09

CWE-521

[email protected]

web.nvd.nist.gov

ibm robotic process automation

weak passwords

user accounts

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

66.1%

JSON

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.

Affected configurations

Nvd

Node

ibmrobotic_process_automation_for_cloud_pakMatch21.0.0

ibmrobotic_process_automation_for_cloud_pakMatch21.0.1

ibmrobotic_process_automation_for_cloud_pakMatch21.0.2

AND

microsoftwindowsMatch-

VendorProductVersionCPE
ibmrobotic_process_automation_for_cloud_pak21.0.0cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak21.0.1cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak21.0.2cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation_for_cloud_pak	21.0.0	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:::::::*
ibm	robotic_process_automation_for_cloud_pak	21.0.1	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:::::::*
ibm	robotic_process_automation_for_cloud_pak	21.0.2	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*