CVE-2023-22863

MEDIUM

IBM Robotic Process Automation 20.12.0-21.0.2 - Cleartext Transmission of Sensitive Information via Default HTTP

Title source: llm
STIX 2.1

Description

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.

References (2)

Core 2
Core References
Patch, Vendor Advisory vendor-advisory
https://www.ibm.com/support/pages/node/6855837

Scores

CVSS v3 5.9
EPSS 0.0011
EPSS Percentile 29.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-319
Status published
Products (3)
ibm/robotic_process_automation < 21.0.3
ibm/robotic_process_automation_as_a_service < 21.0.3
ibm/robotic_process_automation_for_cloud_pak < 21.0.3
Published Jan 18, 2023
Tracked Since Feb 18, 2026