PT-2022-20208 · Ibm · Ibm Robotic Process Automation

Published 2022-07-31 · Updated 2023-08-08 · CVE-2022-30616

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.2

Description The issue allows a privileged user to elevate their privilege to platform administrator through manipulation of APIs.

Recommendations For versions 21.0.0 through 21.0.2, consider restricting access to APIs that can be manipulated to elevate privileges until a patch is available. As a temporary workaround, limit the privileges of users who have access to the affected APIs. Avoid using APIs that allow privilege elevation until the issue is resolved.

Fix

Related Identifiers

CVE-2022-30616

Affected Products

Ibm Robotic Process Automation

References · 5

• https://ibm.com/support/pages/node/6608430 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/227978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30616 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30616 · Vendor Advisory
• https://t.me/cvenotify/34063 · Telegram Post