CVE-2023-22863
First published: Mon Jan 09 2023(Updated: )
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Robotic Process Automation | <=< 21.0.3 | |
| IBM Robotic Process Automation for Cloud Pak | <=< 21.0.3 | |
| IBM Robotic Process Automation as a Service | <=< 21.0.3 | |
| IBM Robotic Process Automation | <21.0.3 | |
| IBM Robotic Process Automation as a Service | <21.0.3 | |
| IBM Robotic Process Automation for Cloud Pak | <21.0.3 | |
| Microsoft Windows | ||
| Redhat Openshift |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this IBM Robotic Process Automation vulnerability?
The vulnerability ID of this IBM Robotic Process Automation vulnerability is CVE-2023-22863.
What is the severity of CVE-2023-22863?
The severity of CVE-2023-22863 is medium.
How does this vulnerability affect IBM Robotic Process Automation?
This vulnerability affects IBM Robotic Process Automation versions up to 21.0.3.
What is the impact of this vulnerability?
The impact of this vulnerability is that it allows an attacker to obtain sensitive information using man-in-the-middle techniques.
How can I fix CVE-2023-22863?
To fix CVE-2023-22863, ensure that the URL in RPA commands explicitly specifies the HTTPS prefix.
- collector/ibm-support
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm robotic process automation
- version/ibm robotic process automation/< 21.0.3
- canonical/ibm robotic process automation for cloud pak
- version/ibm robotic process automation for cloud pak/< 21.0.3
- canonical/ibm robotic process automation as a service
- version/ibm robotic process automation as a service/< 21.0.3
- vendor/microsoft
- canonical/microsoft windows
- vendor/redhat
- canonical/redhat openshift