PT-2018-13064 · Automation Anywhere+1 · Automation Anywhere+1

Published 2018-11-02 · Updated 2019-10-09 · CVE-2018-1552

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere versions 10.0 through 11.0

Description The issue allows a remote attacker to execute arbitrary code on the system due to a missing restriction on file types that can be uploaded to the control room. An attacker can exploit this by uploading a malicious file and tricking a victim into running it, thereby executing arbitrary code on the system.

Recommendations For versions 10.0 through 11.0, restrict access to file uploads in the control room to prevent malicious file uploads until a fix is available. As a temporary workaround, consider implementing strict validation and restriction on file types that can be uploaded to the control room.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-1552

Affected Products

Automation Anywhere

Ibm Robotic Process Automation

References · 4

• https://osv.dev/vulnerability/CVE-2018-1552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1552 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22016247 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/142889 · Vendor Advisory