PT-2023-3555 · Ibm · Ibm Robotic Process Automation

Rahul Singh Thakur + 1 · Published 2023-06-20 · Updated 2023-07-26 · CVE-2023-35901

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.7.6 IBM Robotic Process Automation versions 23.0.0 through 23.0.6

Description The issue is related to weaknesses in the authentication procedure of the software. Exploitation of this issue could allow a remote attacker to read, modify, or delete data. It is also associated with a client-side validation bypass, which could enable invalid changes or values in certain fields.

Recommendations For versions 21.0.0 through 21.0.7.6, update to a version outside of this range to resolve the issue. For versions 23.0.0 through 23.0.6, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and fields to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-03774

CVE-2023-35901

Affected Products

Ibm Robotic Process Automation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-35901 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35901 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/259380 · Vendor Advisory
• https://ibm.com/support/pages/node/7012317 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03774 · Security Note
• https://vuldb.com/ru/?id.234255 · Note