IBM Robotic Process Automation information disclosure
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Robotic Process Automation | 21.0.0 – 21.0.7.4; 23.0.0 – 23.0.5 | — | No fix listed | CNA |
- Robotic Process Automation VendorIBM Affected 21.0.0 – 21.0.7.4; 23.0.0 – 23.0.5 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* | up to 21.0.7.4; 23.0.0 – 23.0.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:* | up to 21.0.7.4; 23.0.0 – 23.0.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* | up to 21.0.7.4; 23.0.0 – 23.0.5 | Vulnerable | IBM |
| cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Hat |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions up to 21.0.7.4; 23.0.0 – 23.0.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_as_a_service:*:*:*:*:*:*:*:* Versions up to 21.0.7.4; 23.0.0 – 23.0.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions up to 21.0.7.4; 23.0.0 – 23.0.5 Vulnerable ·IBM
- cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Hat
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-35900
- 2026-10-03 Alias added: GHSA-c5rc-w46c-83hh
References
More IBM Robotic Process Automation vulnerabilities
- TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
- TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5
Sources
- CVE-2023-35900 · CVE Program
- CVE-2023-35900 · NVD
- FIRST EPSS
- GHSA-c5rc-w46c-83hh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences