PT-2018-13038 · Automation Anywhere+2 · Automation Anywhere+2

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2018-1547

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 10.0

Description The issue is caused by improper output encoding in a CSV export, which could allow a remote attacker to execute arbitrary code on the system. An attacker could exploit this by persuading a victim to download the CSV export, open it in Microsoft Excel, and confirm two security questions, thereby allowing the attacker to run any command or program on the victim's machine.

Recommendations For IBM Robotic Process Automation with Automation Anywhere version 10.0, consider avoiding the use of the CSV export feature until a fix is available, and be cautious when opening CSV files in Microsoft Excel to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-1547

Produtos afetados

Automation Anywhere

Ibm Robotic Process Automation

Office Excel

Referências · 5

• http://ibm.com/support/docview.wss?uid=swg22016197 · Aviso do Fabricante
• http://securityfocus.com/bid/104469 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1547 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1547 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/142651 · Aviso do Fabricante