PT-2023-5438 · Ibm · Ibm Robotic Process Automation

Mariana Faleiros Penna · Publicado 2023-08-02 · Atualizado 2024-09-19 · CVE-2023-23476

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.7.latest

Description The issue is related to insufficient authorization validation on some API routes, which can allow unauthorized access to data. This can potentially enable a remote attacker to disclose protected information about the vulnerable system.

Recommendations For versions 21.0.0 through 21.0.7.latest, consider restricting access to the affected API routes until a patch is available. As a temporary workaround, review and strengthen authorization validation on all API endpoints to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2023-06068

CVE-2023-23476

Produtos afetados

Ibm Robotic Process Automation

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/245425 · Aviso do Fabricante
• https://ibm.com/support/pages/node/7017490 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06068 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-23476 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23476 · Aviso do Fabricante
• https://t.me/cvenotify/95264 · Publicação no Telegram
• https://t.me/cibsecurity/67594 · Publicação no Telegram