JR65046: SECURITY BULLETIN: IBM ROBOTIC PROCESS AUTOMATION IS VULNERABLE TO CROSS TENANT DISCLOSURE OF USER IDS (CVE-2022-30607)

APAR status

• Closed as program error.

Error description

• Summary
  
  IBM Robotic Process Automation is vulnerable to cross tenant
  disclosure of user ids (CVE-2022-30607)
  
  
  Vulnerability Details
  
  CVEID:   CVE-2022-30607
  DESCRIPTION:   IBM Robotic Process Automation contains a
  vulnerability that could allow a user to obtain sensitive
  information due to information properly masked in the control
  center UI.
  CVSS Base score: 2.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All                                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * No further information.                                      *
  *                                                              *
  * PRODUCTS AFFECTED                                            *
  * IBM Robotic Process Automation                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Update to 21.0.2 IF003 or higher.                            *
  ****************************************************************
  

Problem conclusion

• First fixed in 21.0.2 IF003
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RPA

• Fixed component ID

  5737N5100

Applicable component levels