Vulnerability Details : CVE-2023-22863
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
Products affected by CVE-2023-22863
- cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22863
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22863
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
IBM Corporation |
CWE ids for CVE-2023-22863
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by: psirt@us.ibm.com (Primary)
References for CVE-2023-22863
-
https://www.ibm.com/support/pages/node/6855837
Security Bulletin: IBM Robotic Process Automation is vulnerable to man in the middle attacksPatch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/244109
IBM Robotic Process Automation information disclosure CVE-2023-22863 Vulnerability ReportVDB Entry;Vendor Advisory
Jump to