IBM Robotic Process Automation information disclosure
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. IBM X-Force ID: 263470.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Robotic Process Automation | 21.0.0 – 21.0.7.1 | — | No fix listed | CNA |
- Robotic Process Automation VendorIBM Affected 21.0.0 – 21.0.7.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* | 21.0.0 – 21.0.7.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* | 21.0.0 – 21.0.7.1 | Vulnerable | IBM |
| cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Red Hat |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions 21.0.0 – 21.0.7.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions 21.0.0 – 21.0.7.1 Vulnerable ·IBM
- cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Red Hat
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40370
- 2026-10-03 Alias added: GHSA-gfrf-r6q5-j44j
References
More IBM Robotic Process Automation vulnerabilities
- TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
- TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5
Sources
- CVE-2023-40370 · CVE Program
- CVE-2023-40370 · NVD
- FIRST EPSS
- GHSA-gfrf-r6q5-j44j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences