by Kastro
Paper/Archive/CVE-2022-35280

CVE-2022-35280

IBM Robotic Process Automation — IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which make…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.7.567 × 2011.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.

Affected

ProductAffectedFixed inSource
Robotic Process Automation21.0.0–CNA
Robotic Process Automation21.0.1–CNA
Robotic Process Automation21.0.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)4.6CVSS:3.0/AC:L/C:H/UI:N/AV:P/A:N/PR:N/S:U/I:N/E:U/RL:O/RC:C

References

refibm.com/support/pages/node/6610393refexchange.xforce.ibmcloud.com/vulnerabilities/230634