Vulnerability-Lookup

CNVD-2022-77505

Vulnerability from cnvd - Published: 2022-11-16

Title

IBM Robotic Process Automation信息泄露漏洞（CNVD-2022-77505）

Description

IBM Robotic Process Automation是美国IBM公司的一种机器人流程自动化产品。可帮助您以传统RPA的轻松和速度大规模自动化更多业务和IT流程。 IBM Robotic Process Automation存在信息泄露漏洞。攻击者可利用该漏洞通过获取敏感信息进一步攻击系统。

Severity

中

Patch Name

IBM Robotic Process Automation信息泄露漏洞（CNVD-2022-77505）的补丁

Patch Description

IBM Robotic Process Automation是美国IBM公司的一种机器人流程自动化产品。可帮助您以传统RPA的轻松和速度大规模自动化更多业务和IT流程。 IBM Robotic Process Automation存在信息泄露漏洞。攻击者可利用该漏洞通过获取敏感信息进一步攻击系统。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/pages/node/6831681

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-38710

Impacted products

Name
['IBM Robotic Process Automation for Cloud Pak <21.0.3', 'IBM Robotic Process Automation as a Service <21.0.3', 'IBM Robotic Process Automation <21.0.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-38710",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-38710"
    }
  },
  "description": "IBM Robotic Process Automation\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u79cd\u673a\u5668\u4eba\u6d41\u7a0b\u81ea\u52a8\u5316\u4ea7\u54c1\u3002\u53ef\u5e2e\u52a9\u60a8\u4ee5\u4f20\u7edfRPA\u7684\u8f7b\u677e\u548c\u901f\u5ea6\u5927\u89c4\u6a21\u81ea\u52a8\u5316\u66f4\u591a\u4e1a\u52a1\u548cIT\u6d41\u7a0b\u3002\n\nIBM Robotic Process Automation\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u8fdb\u4e00\u6b65\u653b\u51fb\u7cfb\u7edf\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a  http://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/pages/node/6831681",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-77505",
  "openTime": "2022-11-16",
  "patchDescription": "IBM Robotic Process Automation\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u79cd\u673a\u5668\u4eba\u6d41\u7a0b\u81ea\u52a8\u5316\u4ea7\u54c1\u3002\u53ef\u5e2e\u52a9\u60a8\u4ee5\u4f20\u7edfRPA\u7684\u8f7b\u677e\u548c\u901f\u5ea6\u5927\u89c4\u6a21\u81ea\u52a8\u5316\u66f4\u591a\u4e1a\u52a1\u548cIT\u6d41\u7a0b\u3002\r\n\r\nIBM Robotic Process Automation\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u8fdb\u4e00\u6b65\u653b\u51fb\u7cfb\u7edf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Robotic Process Automation\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2022-77505\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Robotic Process Automation for Cloud Pak \u003c21.0.3",
      "IBM Robotic Process Automation as a Service \u003c21.0.3",
      "IBM Robotic Process Automation \u003c21.0.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-38710",
  "serverity": "\u4e2d",
  "submitTime": "2022-11-06",
  "title": "IBM Robotic Process Automation\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2022-77505\uff09"
}

CVE-2022-38710 (GCVE-0-2022-38710)

Vulnerability from cvelistv5 – Published: 2022-11-03 00:00 – Updated: 2024-09-25 18:15

Title

IBM Robotic Process Automation information disclosure

Summary

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-25 18:13 UTC

CWE

CWE-497 - Exposure of System Data to an Unauthorized Control Sphere

Assigner

ibm mitre root

References

2 references

URL	Tags
https://www.ibm.com/support/pages/node/6831681
https://exchange.xforce.ibmcloud.com/vulnerabilit…

Impacted products

1 product

Vendor	Product	Version
IBM	Robotic Process Automation	Affected: 21.0.1, 21.0.2 cpe:2.3:a:ibm:robotic_process_automation:21.0.1:::::::* cpe:2.3:a:ibm:robotic_process_automation:21.0.2:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-38710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T18:13:45.877396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T18:15:08.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T11:02:14.414Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6831681"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/234292"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Robotic Process Automation",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "21.0.1, 21.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system.  IBM X-Force ID:  234292."
            }
          ],
          "value": "IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system.  IBM X-Force ID:  234292."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497 Exposure of System Data to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-21T09:46:16.221Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/6831681"
        },
        {
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/234292"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Robotic Process Automation information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2022-38710",
    "datePublished": "2022-11-03T00:00:00.000Z",
    "dateReserved": "2022-08-23T00:00:00.000Z",
    "dateUpdated": "2024-09-25T18:15:08.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.