Read the docs
TI-2023-24201 Aliases CVE-2023-45189GHSA-6wgw-qc2r-6vj3

IBM Robotic Process Automation information disclosure

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. IBM X-Force ID: 268752.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00632 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMRobotic Process Automation21.0.0 – 21.0.7.10; 23.0.0 – 23.0.10—No fix listedCNA
IBMRobotic Process Automation for Cloud Pak21.0.0 – 21.0.7.10; 23.0.0 – 23.0.10—No fix listedCNA
  • Robotic Process Automation VendorIBM Affected 21.0.0 – 21.0.7.10; 23.0.0 – 23.0.10 Fixed in — No fix listed CNA
  • Robotic Process Automation for Cloud Pak VendorIBM Affected 21.0.0 – 21.0.7.10; 23.0.0 – 23.0.10 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*21.0.0 – 21.0.7; 23.0.0 – 23.0.10VulnerableIBM
  • cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions 21.0.0 – 21.0.7; 23.0.0 – 23.0.10 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45189
  2. 2026-10-03 Alias added: GHSA-6wgw-qc2r-6vj3
  3. 2026-11-02 EPSS moved to the 50th–90th percentile

References

Patch 1

  • TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2022-15958 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users… CVSS 3.1CRITICAL 9.8
  • TI-2022-21522 IBM Robotic Process Automation for Cloud Pak session fixation CVSS 3.1HIGH 8.8
  • TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
  • TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
  • TI-2023-08785 IBM Robotic Process Automation for Cloud Pak cross-site scripting CVSS 3.1MEDIUM 5.4
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences