Lucene search

IBM186C089939AD0266633E435E028426E38A8C1043FCFD5E00380AA4DFD45A2689

HistoryJan 04, 2023 - 9:20 p.m.

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak (CVE-2022-43844)

2023-01-0421:20:33

www.ibm.com

ibm

rpa

cloud pak

logout

redirection

vulnerability

cve-2022-43844

fix

update

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

31.9%

JSON

Summary

IBM Robotic Process Automation for Cloud Pak is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. This bulletin identifies the security fixes to apply to address this vulnerability.

Vulnerability Details

CVEID:CVE-2022-43844
**DESCRIPTION:**IBM Robotic Process Automation for Cloud Pak is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak.
CVSS Base score: 2.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239081 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Robotic Process Automation for Cloud Pak	< 21.0.3.1

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Robotic Process Automation for Cloud Pak	< 21.0.3.1	Update to 21.0.3.1 or higher using the following instructions.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrobotic_process_automationMatch20.12.

ibmrobotic_process_automationMatch21.0.3

CPENameOperatorVersion
ibm robotic process automationeq20.12.
ibm robotic process automationeq21.0.3

CPE	Name	Operator	Version
	ibm robotic process automation	eq	20.12.
	ibm robotic process automation	eq	21.0.3

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

31.9%

JSON

Related for 186C089939AD0266633E435E028426E38A8C1043FCFD5E00380AA4DFD45A2689