Insufficiently protected credentials in IBM Robotic Process Automation



Published: 2023-03-09
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-25680
CWE-ID CWE-522
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
IBM Robotic Process Automation
Server applications / Other server solutions

Robotic Process Automation for Cloud Pak
Other software / Other software solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Insufficiently protected credentials

EUVDB-ID: #VU73190

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25680

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to credentials are not obfuscated while editing queue provider details. An attacker with physical access to the system can obtain credentials of application users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

IBM Robotic Process Automation: 21.0.0 - 21.0.7.1

Robotic Process Automation for Cloud Pak: before 21.0.6

External links

http://www.ibm.com/support/pages/node/6962177


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###