CVE-2023-35900 IBM Robotic Process Automation information disclosure

Medium 4.3 Published 19 Jul 2023 Updated 21 Oct 2024

Attackers can obtain server version information to identify underlying OS vulnerabilities, requiring an upgrade to secure the IBM Robotic Process Automation platform.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35900?

CVE-2023-35900 is a medium-severity vulnerability in IBM Robotic Process Automation, published on 19 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368.

Weakness: CWE-200

Which versions are affected by CVE-2023-35900?

It affects 3 products.

Products include Ibm Robotic Process Automation, Ibm Robotic Process Automation as a Service, Ibm Robotic Process Automation for Cloud Pak.

How do I fix CVE-2023-35900?

No fix has been published for CVE-2023-35900 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-35900 being exploited?

There is no known exploitation of CVE-2023-35900 in the wild and no public exploit code.

Sources

Also known as GHSA-c5rc-w46c-83hh.