PT-2023-18573 · Ibm · Ibm Robotic Process Automation

Publicado 2023-03-15 · Atualizado 2023-03-19 · CVE-2023-22591

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Baixa

Vetor base

AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.1 through 21.0.7 IBM Robotic Process Automation versions 23.0.0 through 23.0.1

Description The issue allows a user with physical access to the system due to session tokens not being invalidated after a password reset.

Recommendations For versions 21.0.1 through 21.0.7, update to a version that includes the fix for the session token invalidation issue. For versions 23.0.0 through 23.0.1, update to a version that includes the fix for the session token invalidation issue. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-22591

Produtos afetados

Ibm Robotic Process Automation

Referências · 7

• https://ibm.com/support/pages/node/6962175 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22591 · Aviso do Fabricante
• https://t.me/cibsecurity/60092 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22591 · Nota de Segurança
• https://t.me/cvenotify/46272 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/243710 · Aviso do Fabricante
• https://t.me/cvenotify/46469 · Publicação no Telegram