PT-2023-18573 · Ibm · Ibm Robotic Process Automation

Published 2023-03-15 · Updated 2023-03-19 · CVE-2023-22591

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.1 through 21.0.7 IBM Robotic Process Automation versions 23.0.0 through 23.0.1

Description The issue allows a user with physical access to the system due to session tokens not being invalidated after a password reset.

Recommendations For versions 21.0.1 through 21.0.7, update to a version that includes the fix for the session token invalidation issue. For versions 23.0.0 through 23.0.1, update to a version that includes the fix for the session token invalidation issue. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-22591

Affected Products

Ibm Robotic Process Automation

References · 7

• https://ibm.com/support/pages/node/6962175 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22591 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/243710 · Vendor Advisory
• https://t.me/cibsecurity/60092 · Telegram Post
• https://t.me/cvenotify/46272 · Telegram Post
• https://t.me/cvenotify/46469 · Telegram Post