CVE-2022-35280

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/230634	Broken Link
https://www.ibm.com/support/pages/node/6610393	Broken Link

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:::::::*
	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:::::::*
	cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:::::::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-10 17:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-35280

Mitre link : CVE-2022-35280

CVE.ORG link : CVE-2022-35280

JSON object : View

Products Affected

ibm

robotic_process_automation_for_cloud_pak

microsoft

windows

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2022-35280", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-08-10T17:15:09.280", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/230634", "tags": ["Broken Link"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6610393", "tags": ["Broken Link"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634."}, {"lang": "es", "value": "IBM Robotic Process Automation versiones 21.0.0, 21.0.1 y 21.0.2, no exige que usuarios tengan contrase\u00f1as seguras por defecto, lo que facilita que atacantes puedan comprometer las cuentas de usuarios. IBM X-Force ID: 230634"}], "lastModified": "2022-08-13T00:16:38.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0C0A1A1-12D0-43A0-8F1C-534BCCD77A59"}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DFB04F3-FC7A-472B-BAC5-8EAA378C8390"}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69999572-5E34-4C34-A40C-899E898578CF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}