Lucene search

IbmCVE-2023-38734

HistoryAug 22, 2023 - 10:15 p.m.

CVE-2023-38734

2023-08-2222:15:08

CWE-269

ibm

web.nvd.nist.gov

ibm

rpa

robotic process automation

cve-2023-38734

security

vulnerability

ldap

privilege assignment

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

48.7%

JSON

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.

Affected configurations

Nvd

Vulners

Node

ibmrobotic_process_automationRange21.0.0–21.0.7.1

ibmrobotic_process_automationMatch23.0.0

ibmrobotic_process_automationMatch23.0.1

AND

redhatopenshiftMatch-

microsoftwindowsMatch-

VendorProductVersionCPE
ibmrobotic_process_automation*cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*
ibmrobotic_process_automation23.0.0cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*
ibmrobotic_process_automation23.0.1cpe:2.3:a:ibm:robotic_process_automation:23.0.1:*:*:*:*:*:*:*
redhatopenshift-cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation	*	cpe:2.3:a:ibm:robotic_process_automation::::::::
ibm	robotic_process_automation	23.0.0	cpe:2.3:a:ibm:robotic_process_automation:23.0.0:::::::*
ibm	robotic_process_automation	23.0.1	cpe:2.3:a:ibm:robotic_process_automation:23.0.1:::::::*
redhat	openshift	-	cpe:2.3:a:redhat:openshift:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Robotic Process Automation",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "21.0.7.1",
        "status": "affected",
        "version": "21.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "23.0.1",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/262481

www.ibm.com/support/pages/node/7028227

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

48.7%

JSON

Related for CVE-2023-38734