CVE-2023-35901

2023-07-1700:15:09

CWE-287

[email protected]

web.nvd.nist.gov

ibm

rpa

vulnerable

client side validation

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

35.1%

JSON

IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.

Affected configurations

Nvd

Node

redhatopenshiftMatch-

microsoftwindowsMatch-

AND

ibmrobotic_process_automationRange21.0.0–21.0.7.6

ibmrobotic_process_automationRange23.0.0–23.0.6

ibmrobotic_process_automation_as_a_serviceRange21.0.0–21.0.7.6

ibmrobotic_process_automation_for_cloud_pakRange21.0.0–21.0.7.6

ibmrobotic_process_automation_for_cloud_pakRange23.0.0–23.0.6

VendorProductVersionCPE
redhatopenshift-cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
ibmrobotic_process_automation*cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*
ibmrobotic_process_automation_as_a_service*cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:*
ibmrobotic_process_automation_for_cloud_pak*cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openshift	-	cpe:2.3:a:redhat:openshift:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
ibm	robotic_process_automation	*	cpe:2.3:a:ibm:robotic_process_automation::::::::
ibm	robotic_process_automation_as_a_service	*	cpe:2.3:a:ibm:robotic_process_automation_as_a_service::::::::
ibm	robotic_process_automation_for_cloud_pak	*	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak::::::::