IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/244109 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6855837 | Patch Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/244109 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6855837 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/244109 - VDB Entry, Vendor Advisory | |
| References | () https://www.ibm.com/support/pages/node/6855837 - Patch, Vendor Advisory |
07 Nov 2023, 04:07
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109. |
Information
Published : 2023-01-18 19:15
Updated : 2024-11-21 07:45
NVD link : CVE-2023-22863
Mitre link : CVE-2023-22863
CVE.ORG link : CVE-2023-22863
JSON object : View
Products Affected
ibm
- robotic_process_automation_for_cloud_pak
- robotic_process_automation_as_a_service
- robotic_process_automation
microsoft
- windows
redhat
- openshift
CWE
CWE-319
Cleartext Transmission of Sensitive Information