PT-2023-5437 · Ibm · Ibm Robotic Process Automation

Mariana Penna · Published 2023-08-22 · Updated 2023-08-26 · CVE-2023-40370

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1

Description The issue is related to information disclosure of script content in IBM Robotic Process Automation when the remote REST request computer policy is enabled. This could allow a remote attacker to disclose protected information.

Recommendations For versions 21.0.0 through 21.0.7.1, consider disabling the remote REST request computer policy as a temporary workaround until a patch is available. Restrict access to sensitive script content to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-06067

CVE-2023-40370

Affected Products

Ibm Robotic Process Automation

References · 7

• https://ibm.com/support/pages/node/7028218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40370 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40370 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/263470 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06067 · Security Note
• https://t.me/cvenotify/57113 · Telegram Post
• https://t.me/cibsecurity/69041 · Telegram Post