Ramandeep Kaur

**Name of the Vulnerable Software and Affected Versions** IBM Robotic Process Automation versions 21.0.0 through 21.0.7.18 IBM Robotic Process Automation versions 23.0.0 through 23.0.18 IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.18 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.18 **Description** The issue is related to improper validation of client-side security enforcement, which could allow an authenticated user to perform unauthorized actions as a privileged user. This can be exploited by a remote attacker to elevate their privileges. **Recommendations** For IBM Robotic Process Automation versions 21.0.0 through 21.0.7.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation versions 23.0.0 through 23.0.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.18, update to a version that properly validates client-side security enforcement. As a temporary workaround, consider restricting access to privileged user actions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.4 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.5 **Description** The issue is related to the disclosure of server version information, which could be used to determine software vulnerabilities at the operating system level. This is due to a lack of protection for service data. An attacker, acting remotely, could exploit this to reveal protected information. **Recommendations** For versions 21.0.0 through 21.0.7.4, update to a version outside of this range to mitigate the risk. For versions 23.0.0 through 23.0.5, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to sensitive information and server version details until a patch is available.