PT-2018-13038 · Automation Anywhere+2 · Automation Anywhere+2

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-1547

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 10.0

Description The issue is caused by improper output encoding in a CSV export, which could allow a remote attacker to execute arbitrary code on the system. An attacker could exploit this by persuading a victim to download the CSV export, open it in Microsoft Excel, and confirm two security questions, thereby allowing the attacker to run any command or program on the victim's machine.

Recommendations For IBM Robotic Process Automation with Automation Anywhere version 10.0, consider avoiding the use of the CSV export feature until a fix is available, and be cautious when opening CSV files in Microsoft Excel to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-1547

Affected Products

Automation Anywhere

Ibm Robotic Process Automation

Office Excel

References · 5

• http://ibm.com/support/docview.wss?uid=swg22016197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1547 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1547 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/142651 · Vendor Advisory
• http://securityfocus.com/bid/104469 · Note