PT-2018-14345 · Automation Anywhere+1 · Automation Anywhere Enterprise+1

Publicado 2018-10-05 · Atualizado 2019-10-09 · CVE-2018-1812

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere Enterprise version 10

Description The issue is caused by missing escaping of a database field, leading to persistent cross-site scripting. An attacker with access to the Control Room database could exploit this to execute script in a victim's web browser within the security context of the hosting Web site, once the victim opens a certain page in Control Room.

Recommendations For IBM Robotic Process Automation with Automation Anywhere Enterprise version 10, consider restricting access to the Control Room database to minimize the risk of exploitation. As a temporary workaround, limit the ability to open certain pages in Control Room until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1812

Produtos afetados

Automation Anywhere Enterprise

Ibm Robotic Process Automation

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/149883 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=ibm10731925 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1812 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1812 · Nota de Segurança