CVE-2023-40370
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 is vulnerable to information disclosure of script content if the remote REST request policy is enabled.
Risk Assessment
Disclosure of script content may lead to leakage of sensitive information, posing a security threat to the organization.
Recommendation
It is recommended to disable the remote REST request policy or update to the latest version to minimize risk.
Other vulnerabilities in IBM Robotic Process Automation
See all- CVE-2023-38734Medium
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory.
- CVE-2023-38733Medium
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 may allow an authenticated user to view sensitive information from installation logs.
- CVE-2023-38732Medium
IBM Robotic Process Automation server versions 21.0.0 through 21.0.7 could allow an authenticated user to view sensitive information from application logs.
- CVE-2023-35901Low
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 are vulnerable to client side validation bypass, which could allow invalid changes or values in some fields.
Original NVD description (English source)
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS