PT-2022-15428 · Ibm · Ibm Robotic Process Automation

Published 2022-05-05 · Updated 2022-05-16 · CVE-2022-22433

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.1 through 21.0.2

Description The issue is caused by improper validation of user-supplied input, allowing a remote attacker to exploit the vulnerability and induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

Recommendations For versions 21.0.1 and 21.0.2, consider restricting access to the application to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the application for tasks that involve user-supplied input.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-22433

Affected Products

Ibm Robotic Process Automation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22433 · Security Note
• https://ibm.com/support/pages/node/6573913 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22433 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/224156 · Vendor Advisory
• https://t.me/cibsecurity/42015 · Telegram Post
• https://t.me/cvenotify/30272 · Telegram Post