CVE-2022-22490
published 2022-08-10CVE-2022-22490: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID…
PriorityP422medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.66%
47.3th percentile
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | robotic_process_automation | < 21.0.3 | 21.0.3 |
| ibm | robotic_process_automation | — | — |
| ibm | robotic_process_automation | — | — |
| ibm | robotic_process_automation | — | — |
| ibm | robotic_process_automation_for_cloud_pak | < 21.0.3 | 21.0.3 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv3.04.4MEDIUMCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8ph8-qhj8-87rw: IBM Robotic Process Automation 21
ghsa_unreviewed·2022-08-11
CVE-2022-22490 [MEDIUM] CWE-552 GHSA-8ph8-qhj8-87rw: IBM Robotic Process Automation 21
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
Red Hat
git: data exfiltration with maliciously crafted repository
vendor_redhat·2023-02-14·CVSS 5.5
CVE-2023-22490 [MEDIUM] CWE-402 git: data exfiltration with maliciously crafted repository
git: data exfiltration with maliciously crafted repository
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.
A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.3
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-10
Published