PT-2019-17021 · Automation Anywhere+1 · Automation Anywhere+1

Published 2019-07-01 · Updated 2022-12-06 · CVE-2019-4297

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

C:L/PR:L/AV:N/AC:L/I:L/UI:N/A:N/S:C

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 11

Description The issue allows a remote authenticated attacker to conduct an LDAP injection by using a specially crafted request. This could enable the attacker to make unauthorized queries or modify the LDAP content.

Recommendations For IBM Robotic Process Automation with Automation Anywhere version 11, consider restricting access to the LDAP functionality until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2019-4297

Affected Products

Automation Anywhere

Ibm Robotic Process Automation

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/160761 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10884826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4297 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4297 · Vendor Advisory