PT-2018-13064 · Automation Anywhere+1 · Automation Anywhere+1

Publicado 2018-11-02 · Atualizado 2019-10-09 · CVE-2018-1552

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere versions 10.0 through 11.0

Description The issue allows a remote attacker to execute arbitrary code on the system due to a missing restriction on file types that can be uploaded to the control room. An attacker can exploit this by uploading a malicious file and tricking a victim into running it, thereby executing arbitrary code on the system.

Recommendations For versions 10.0 through 11.0, restrict access to file uploads in the control room to prevent malicious file uploads until a fix is available. As a temporary workaround, consider implementing strict validation and restriction on file types that can be uploaded to the control room.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-1552

Produtos afetados

Automation Anywhere

Ibm Robotic Process Automation

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-1552 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1552 · Nota de Segurança
• http://ibm.com/support/docview.wss?uid=swg22016247 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/142889 · Aviso do Fabricante