CVE-2023-35901 IBM Robotic Process Automation security bypass

Low 2.7 Published 16 Jul 2023 Updated 22 Oct 2024

Attackers can bypass client-side validation to inject invalid data, compromising data integrity in IBM Robotic Process Automation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35901?

CVE-2023-35901 is a low-severity vulnerability in IBM Robotic Process Automation, published on 16 Jul 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.

Weakness: CWE-287

Which versions are affected by CVE-2023-35901?

It affects 3 products.

Products include Ibm Robotic Process Automation, Ibm Robotic Process Automation as a Service, Ibm Robotic Process Automation for Cloud Pak.

How do I fix CVE-2023-35901?

No fix has been published for CVE-2023-35901 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-35901 being exploited?

There is no known exploitation of CVE-2023-35901 in the wild and no public exploit code.

Sources

Also known as GHSA-c5rv-3w8m-4v6h.