CVE-2022-42442: IBM Robotic Process Automation for Cloud Pak E-mail Exposure Vulnerability Exploit Details

IBM Robotic Process Automation (RPA) for Cloud Pak is a comprehensive solution that enables organizations to automate repetitive, routine tasks using AI and machine learning capabilities. It is designed to reduce the time and cost of executing business processes while increasing efficiency and productivity. IBM RPA for Cloud Pak is an effective solution for companies of all sizes, transforming the way work gets done across industries.

However, it has recently been discovered that there is a vulnerability in IBM RPA for Cloud Pak, specifically affecting versions 21..1, 21..2, 21..3, 21..4, and 21..5. This vulnerability allows for the exposure of the first tenant owner's e-mail address to users with access to the container platform. This has serious implications for the security and privacy of the affected accounts. This blog post details the exploit associated with CVE-2022-42442, including code snippets, links to original sources, and specific exploit details.

IBM's official security advisory can be found at the following link

IBM Security Advisory

Vulnerable Versions

IBM RPA for Cloud Pak 21..1, 21..2, 21..3, 21..4, and 21..5

Exploit Details

The vulnerability in IBM RPA for Cloud Pak has been identified as a result of incorrect access controls and scope implementation. With this vulnerability, an authenticated user with access to the container platform can potentially see the e-mail address of the first tenant owner. This is a significant

Timeline

Published on: 11/03/2022 20:15:00 UTC
Last modified on: 05/12/2023 00:15:00 UTC