CVE-2023-38734
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory.
Risk Assessment
Incorrect privilege assignment may lead to unauthorized access to the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update to the latest version of the software to mitigate this vulnerability and review user privileges after importing from LDAP.
Other vulnerabilities in IBM Robotic Process Automation
See all- CVE-2023-40370Low
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 is vulnerable to information disclosure of script content if the remote REST request policy is enabled.
- CVE-2023-38733Medium
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 may allow an authenticated user to view sensitive information from installation logs.
- CVE-2023-38732Medium
IBM Robotic Process Automation server versions 21.0.0 through 21.0.7 could allow an authenticated user to view sensitive information from application logs.
- CVE-2023-35901Low
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 are vulnerable to client side validation bypass, which could allow invalid changes or values in some fields.
Original NVD description (English source)
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS