PT-2022-23204 · Blue Prism · Blue Prism Enterprise

Published 2022-08-25 · Updated 2023-08-08 · CVE-2022-36116

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Blue Prism Enterprise versions 6.0 through 7.01

Description An issue allows an authenticated user to reverse engineer the software and circumvent access controls for the setValidationInfo administrative function in a misconfigured environment that exposes the Blue Prism Application server. This could increase the chance of successfully hiding malicious code that could be executed in a production environment.

Recommendations For Blue Prism Enterprise versions 6.0 through 7.01, consider restricting access to the setValidationInfo administrative function to minimize the risk of exploitation. Additionally, ensure proper configuration of the environment to prevent exposure of the Blue Prism Application server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-36116

Affected Products

Blue Prism Enterprise

References · 5

• https://portal.blueprism.com/security-vulnerabilities-august-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36116 · Security Note
• https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36116 · Vendor Advisory
• https://blueprism.com · Note