Lucene search

IbmCVE-2022-35280

HistoryAug 10, 2022 - 5:15 p.m.

CVE-2022-35280

2022-08-1017:15:09

CWE-521

ibm

web.nvd.nist.gov

ibm

robotic process automation

rpa

security

vulnerability

password

ibm x-force

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.

Affected configurations

Nvd

Vulners

Node

ibmrobotic_process_automation_for_cloud_pakMatch21.0.0

ibmrobotic_process_automation_for_cloud_pakMatch21.0.1

ibmrobotic_process_automation_for_cloud_pakMatch21.0.2

AND

microsoftwindowsMatch-

VendorProductVersionCPE
ibmrobotic_process_automation_for_cloud_pak21.0.0cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak21.0.1cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak21.0.2cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation_for_cloud_pak	21.0.0	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:::::::*
ibm	robotic_process_automation_for_cloud_pak	21.0.1	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:::::::*
ibm	robotic_process_automation_for_cloud_pak	21.0.2	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Robotic Process Automation",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "21.0.0"
      },
      {
        "status": "affected",
        "version": "21.0.1"
      },
      {
        "status": "affected",
        "version": "21.0.2"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/230634

www.ibm.com/support/pages/node/6610393

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

Related for CVE-2022-35280