Robotic Process Automation With Automation Anywhere
CVE-2018-1547
HIGH
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651.
AnalysisAI
IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. Rated high severity (CVSS 7.7), this vulnerability is no authentication required.
Technical ContextAI
IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651. Affected products include: Ibm Robotic Process Automation With Automation Anywhere.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a
IBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to execute arbitrary code
IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could all
IBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive information in the form of unenc
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access
IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. Rated mediu
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive informati
IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control
IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. Rated medium sever
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDA
IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting,
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due t
Share
External POC / Exploit Code
Leaving vuln.today