Lucene search

IbmCVE-2023-35900

HistoryJul 19, 2023 - 1:15 a.m.

CVE-2023-35900

2023-07-1901:15:10

CWE-200

ibm

web.nvd.nist.gov

ibm

rpa

cloud pak

vulnerability

disclosure

version information

nvd

cve-2023-35900

259368

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

26.6%

JSON

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368.

Affected configurations

Nvd

Vulners

Node

ibmrobotic_process_automationRange≤21.0.7.4

ibmrobotic_process_automationRange23.0.0–23.0.5

ibmrobotic_process_automation_as_a_serviceRange≤21.0.7.4

ibmrobotic_process_automation_as_a_serviceRange23.0.0–23.0.5

ibmrobotic_process_automation_for_cloud_pakRange≤21.0.7.4

ibmrobotic_process_automation_for_cloud_pakRange23.0.0–23.0.5

AND

redhatopenshiftMatch-

microsoftwindowsMatch-

VendorProductVersionCPE
ibmrobotic_process_automation*cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*
ibmrobotic_process_automation_as_a_service*cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak*cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*
redhatopenshift-cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation	*	cpe:2.3:a:ibm:robotic_process_automation::::::::
ibm	robotic_process_automation_as_a_service	*	cpe:2.3:a:ibm:robotic_process_automation_as_a_service::::::::
ibm	robotic_process_automation_for_cloud_pak	*	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak::::::::
redhat	openshift	-	cpe:2.3:a:redhat:openshift:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Robotic Process Automation",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "21.0.7.4",
        "status": "affected",
        "version": "21.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "23.0.5",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/259368

www.ibm.com/support/pages/node/7010895

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

26.6%

JSON

Related for CVE-2023-35900