PT-2022-23208 · Blue Prism · Blue Prism Enterprise

Published 2022-08-25 · Updated 2023-08-08 · CVE-2022-36120

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blue Prism Enterprise versions 6.0 through 7.01

Description The issue allows an authenticated user to reverse engineer the software and circumvent access controls for the getChartData administrative function in a misconfigured environment that exposes the Blue Prism Application server. Using a low/no privilege Blue Prism user account, the attacker can alter the server's settings by abusing the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name.

Recommendations For Blue Prism Enterprise versions 6.0 through 7.01, consider restricting access to the getChartData administrative function to prevent abuse and limit the execution of MSSQL stored procedures. As a temporary workaround, consider disabling the getChartData method until a proper configuration or patch is available to prevent the circumvention of access controls.

Fix

Related Identifiers

CVE-2022-36120

Affected Products

Blue Prism Enterprise

References · 6

• https://blueprism.com · Vendor Advisory
• https://portal.blueprism.com/security-vulnerabilities-august-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36120 · Security Note
• https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise · Vendor Advisory
• https://t.me/cvenotify/35189 · Telegram Post