A vulnerability was found in IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak up to 21.0.7.10/23.0.10 (Automation Software) and classified as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. IBM X-Force ID: 268752.

The weakness was released 11/04/2023. The advisory is shared at ibm.com. The identification of this vulnerability is CVE-2023-45189 since 10/05/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (268752).

Productinfo

Type

• Automation Software

Vendor

• IBM

Name

• Robotic Process Automation
• Robotic Process Automation for Cloud Pak

Version

• 21.0.7.0
• 21.0.7.1
• 21.0.7.2
• 21.0.7.3
• 21.0.7.4
• 21.0.7.5
• 21.0.7.6
• 21.0.7.7
• 21.0.7.8
• 21.0.7.9
• 21.0.7.10
• 23.0.0
• 23.0.1
• 23.0.2
• 23.0.3
• 23.0.4
• 23.0.5
• 23.0.6
• 23.0.7
• 23.0.8
• 23.0.9
• 23.0.10

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion