CVE-2023-38718 IBM Robotic Process Automation information disclosure
Attackers can access sensitive information from RPA scripts and workflows, requiring IBM RPA users to apply vendor patches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38718?
CVE-2023-38718 is a low-severity vulnerability in IBM Robotic Process Automation, published on 20 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Force ID: 261606.
Weakness: CWE-200
Which versions are affected by CVE-2023-38718?
It affects 1 product.
Products include Ibm Robotic Process Automation.
How do I fix CVE-2023-38718?
No fix has been published for CVE-2023-38718 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38718 being exploited?
There is no known exploitation of CVE-2023-38718 in the wild and no public exploit code.
Other vulnerabilities in IBM Robotic Process Automation
- CVE-2022-30616 Privilege escalation in Robotic Process Automation
- CVE-2022-43574 Missing authorization in IBM Robotic Process Automation
- CVE-2024-51448 IBM Robotic Process Automation privilege escalation
- CVE-2023-38734 IBM Robotic Process Automation privilege escalation
- CVE-2024-49824 IBM Robotic Process Automation security bypass
Sources
Also known as GHSA-jfr3-jvfg-j4fw.