CVE-2022-36774

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.1%
top 74.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Robotic Process AutomationIBM Robotic Process Automation AS A ServiceIBM Robotic Process Automation FOR Cloud PAK
Timeline
PublishedOct 6

Description

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDibm/robotic_process_automation21.0.0 — 21.0.3
▶CVEListV5ibm/robotic_process_automation21.0.0, 21.0.1, 21.0.2+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-26v8-q35j-h6q9: IBM Robotic Process Automation 21↗2022-10-06
▶
CVEList
CVE-2022-36774: IBM Robotic Process Automation 21↗2022-10-06
▶
CVE-2022-36774 (MEDIUM CVSS 5.3) | IBM Robotic Process Automation 21.0 | cvebase.io