CVE-2022-22502: XSS
First published: Wed Jun 22 2022(Updated: )
IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227124.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Robotic Process Automation | >=21.0.1<21.0.1.5 | |
| IBM Robotic Process Automation | >=21.0.2<21.0.2.2 | |
| IBM Robotic Process Automation as a Service | <21.0.2.2 | |
| IBM Robotic Process Automation for Cloud Pak | <21.0.2.2 | |
| <=< 21.0.2.2 | ||
| <=< 21.0.2.2 | ||
| <=< 21.0.1.5 | ||
| <=< 21.0.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-22502?
CVE-2022-22502 is a vulnerability in IBM Robotic Process Automation that allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
How severe is CVE-2022-22502?
CVE-2022-22502 has a severity rating of 5.4 (medium).
Which software versions are affected by CVE-2022-22502?
IBM Robotic Process Automation versions up to and including 21.0.2.2, IBM Robotic Process Automation as a Service versions up to and including 21.0.2.2, and IBM Robotic Process Automation for Cloud Pak versions up to and including 21.0.2.2 are affected by CVE-2022-22502.
How can I fix CVE-2022-22502?
To fix CVE-2022-22502, apply the relevant patch provided by IBM. Links to the patches can be found in the references section.
What is CWE-79?
CWE-79 is a Common Weakness Enumeration category that refers to cross-site scripting (XSS) vulnerabilities.
- agent/type
- agent/references
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm robotic process automation
- version/ibm robotic process automation/21.0.1
- version/ibm robotic process automation/21.0.2
- canonical/ibm robotic process automation as a service
- canonical/ibm robotic process automation for cloud pak
- version/ibm robotic process automation as a service/< 21.0.2.2
- version/ibm robotic process automation/< 21.0.2.2
- version/ibm robotic process automation/< 21.0.1.5
- version/ibm robotic process automation for cloud pak/< 21.0.2.2