IBM Robotic Process Automation information disclosure
Priority LOW 26CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Robotic Process Automation (IBM): 21.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Robotic Process Automation | 20.12.0 to before 21.0.2 | 21.0.2 | Patch available | CNA |
- Robotic Process Automation VendorIBM Affected 20.12.0 to before 21.0.2 Fixed in 21.0.2 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* | before 21.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:* | before 21.0.3 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* | before 21.0.3 | Vulnerable | IBM |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:redhat:openshift:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Hat |
- cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions before 21.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:* Versions before 21.0.3 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions before 21.0.3 Vulnerable ·IBM
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:redhat:openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Hat
Remediation
- Fix · CNA Robotic Process Automation (IBM) Fixed in 21.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22863
- 2026-10-03 Alias added: GHSA-2r26-hc5x-pcmw
References
More IBM Robotic Process Automation vulnerabilities
- TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
- TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5
Sources
- CVE-2023-22863 · CVE Program
- CVE-2023-22863 · NVD
- FIRST EPSS
- GHSA-2r26-hc5x-pcmw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences