TI-2023-08785 Aliases CVE-2023-22594 GHSA-8578-jc59-48g2

IBM Robotic Process Automation for Cloud Pak cross-site scripting

LOW 33CWE-79Published 2023-01-18 · Updated 2025-04-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244075.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00381 32nd percentileScored 2026-11-07

Fix Fixed Robotic Process Automation for Cloud Pak (IBM): 21.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Robotic Process Automation for Cloud Pak	20.12.0 to before 21.0.4	21.0.4	Patch available	CNA

Robotic Process Automation for Cloud Pak VendorIBM Affected 20.12.0 to before 21.0.4 Fixed in 21.0.4 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:robotic_process_automation::::::::	before 21.0.5	Vulnerable	IBM
cpe:2.3:a:ibm:robotic_process_automation_as_a_service::::::::	before 21.0.5	Vulnerable	IBM
cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak::::::::	before 21.0.5	Vulnerable	IBM
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:redhat:openshift:-:::::::*	not specified by NVD	Running on	Red Hat

cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions before 21.0.5 Vulnerable ·IBM
cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:* Versions before 21.0.5 Vulnerable ·IBM
cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions before 21.0.5 Vulnerable ·IBM
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:redhat:openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Hat

Remediation

Fix · CNA Robotic Process Automation for Cloud Pak (IBM) Fixed in 21.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-01-18
IBM Robotic Process Automation for Cloud Pak 21.0.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-08783 IBM Robotic Process Automation for Cloud Pak insufficient permission settingsPriority LOW 33
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-22594
2026-10-03 Alias added: GHSA-8578-jc59-48g2

References

Patch 1

https://www.ibm.com/support/pages/node/6855835

TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences