CVE-2023-22863: IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
Other sources
IBM Robotic Process Automation defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this IBM Robotic Process Automation vulnerability?
The vulnerability ID of this IBM Robotic Process Automation vulnerability is CVE-2023-22863.
What is the severity of CVE-2023-22863?
The severity of CVE-2023-22863 is medium.
How does this vulnerability affect IBM Robotic Process Automation?
This vulnerability affects IBM Robotic Process Automation versions up to 21.0.3.
What is the impact of this vulnerability?
The impact of this vulnerability is that it allows an attacker to obtain sensitive information using man-in-the-middle techniques.
How can I fix CVE-2023-22863?
To fix CVE-2023-22863, ensure that the URL in RPA commands explicitly specifies the HTTPS prefix.