CVE-2022-30607 - Vulnerability Details

Vendors	Products
Ibm	Robotic Process Automation
Microsoft	Windows

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/227294
https://www.ibm.com/support/pages/node/6595759

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Robotic Process Automation", "vendor": "IBM", "versions": [{"status": "affected", "version": "21.0.0"}, {"status": "affected", "version": "21.0.1"}, {"status": "affected", "version": "21.0.2"}, {"status": "affected", "version": "20.10.0"}, {"status": "affected", "version": "20.12.5"}]}], "datePublic": "2022-06-16T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 2.4, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.0/PR:H/C:L/AV:N/I:N/A:N/S:U/UI:N/AC:L/E:U/RL:O/RC:C", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-06-17T15:20:16", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/pages/node/6595759"}, {"name": "ibm-rpa-cve202230607-info-disc (227294)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227294"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2022-06-16T00:00:00", "ID": "CVE-2022-30607", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Robotic Process Automation", "version": {"version_data": [{"version_value": "21.0.0"}, {"version_value": "21.0.1"}, {"version_value": "21.0.2"}, {"version_value": "20.10.0"}, {"version_value": "20.12.5"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294."}]}, "impact": {"cvssv3": {"BM": {"A": "N", "AC": "L", "AV": "N", "C": "L", "I": "N", "PR": "H", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "https://www.ibm.com/support/pages/node/6595759", "refsource": "CONFIRM", "title": "IBM Security Bulletin 6595759 (Robotic Process Automation)", "url": "https://www.ibm.com/support/pages/node/6595759"}, {"name": "ibm-rpa-cve202230607-info-disc (227294)", "refsource": "XF", "title": "X-Force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227294"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:56:13.182Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.ibm.com/support/pages/node/6595759"}, {"name": "ibm-rpa-cve202230607-info-disc (227294)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227294"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2022-30607", "datePublished": "2022-06-17T15:20:16.163512Z", "dateReserved": "2022-05-12T00:00:00", "dateUpdated": "2024-09-16T21:57:48.331Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Robotic Process Automation (string)

vendor : IBM (string)

versions : [ »

0 : { »

status : affected (string)

version : 21.0.0 (string)

}

1 : { »

status : affected (string)

version : 21.0.1 (string)

}

2 : { »

status : affected (string)

version : 21.0.2 (string)

}

3 : { »

status : affected (string)

version : 20.10.0 (string)

}

4 : { »

status : affected (string)

version : 20.12.5 (string)

}

]

}

]

datePublic : 2022-06-16T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294. (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

exploitCodeMaturity : UNPROVEN (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

remediationLevel : OFFICIAL_FIX (string)

reportConfidence : CONFIRMED (string)

scope : UNCHANGED (string)

temporalScore : 2.4 (number)

temporalSeverity : LOW (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/PR:H/C:L/AV:N/I:N/A:N/S:U/UI:N/AC:L/E:U/RL:O/RC:C (string)

version : 3.0 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Obtain Information (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-06-17T15:20:16 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.ibm.com/support/pages/node/6595759 (string)

}

1 : { »

name : ibm-rpa-cve202230607-info-disc (227294) (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_XF (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

DATE_PUBLIC : 2022-06-16T00:00:00 (string)

ID : CVE-2022-30607 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Robotic Process Automation (string)

version : { »

version_data : [ »

0 : { »

version_value : 21.0.0 (string)

}

1 : { »

version_value : 21.0.1 (string)

}

2 : { »

version_value : 21.0.2 (string)

}

3 : { »

version_value : 20.10.0 (string)

}

4 : { »

version_value : 20.12.5 (string)

}

]

}

]

}

vendor_name : IBM (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294. (string)

}

]

}

impact : { »

cvssv3 : { »

BM : { »

A : N (string)

AC : L (string)

AV : N (string)

C : L (string)

I : N (string)

PR : H (string)

S : U (string)

UI : N (string)

}

TM : { »

E : U (string)

RC : C (string)

RL : O (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Obtain Information (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.ibm.com/support/pages/node/6595759 (string)

refsource : CONFIRM (string)

title : IBM Security Bulletin 6595759 (Robotic Process Automation) (string)

url : https://www.ibm.com/support/pages/node/6595759 (string)

}

1 : { »

name : ibm-rpa-cve202230607-info-disc (227294) (string)

refsource : XF (string)

title : X-Force Vulnerability Report (string)

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T06:56:13.182Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.ibm.com/support/pages/node/6595759 (string)

}

1 : { »

name : ibm-rpa-cve202230607-info-disc (227294) (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_XF (string)

2 : x_transferred (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2022-30607 (string)

datePublished : 2022-06-17T15:20:16.163512Z (string)

dateReserved : 2022-05-12T00:00:00 (string)

dateUpdated : 2024-09-16T21:57:48.331Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:robotic_process_automation:20.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "5557A68E-A1E0-483B-BB28-AB66E550991E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation:20.12.5:*:*:*:*:*:*:*", "matchCriteriaId": "CCD1246A-C063-43B6-9865-7D4F38366EC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0223822C-1F70-42C0-8C6B-614319B243DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E3E0B42-AA05-448E-8922-AF0594D93193", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "91E94D18-3EB1-46C0-8088-6D7ED5081902", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294."}, {"lang": "es", "value": "IBM Robotic Process Automation versiones 20.10.0, 20.12.5, 21.0.0, 21.0.1 y 21.0.2, contiene una vulnerabilidad que podr\u00eda permitir a un usuario obtener informaci\u00f3n confidencial debido a una informaci\u00f3n correctamente enmascarada en la interfaz de usuario del centro de control. IBM X-Force ID: 227294"}], "id": "CVE-2022-30607", "lastModified": "2024-11-21T07:03:01.047", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-17T16:15:08.617", "references": [{"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227294"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6595759"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/227294"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6595759"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:20.10.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 5557A68E-A1E0-483B-BB28-AB66E550991E (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:20.12.5:*:*:*:*:*:*:* (string)

matchCriteriaId : CCD1246A-C063-43B6-9865-7D4F38366EC7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 0223822C-1F70-42C0-8C6B-614319B243DD (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E3E0B42-AA05-448E-8922-AF0594D93193 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 91E94D18-3EB1-46C0-8088-6D7ED5081902 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2572D17-1DE6-457B-99CC-64AFD54487EA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294. (string)

}

1 : { »

lang : es (string)

value : IBM Robotic Process Automation versiones 20.10.0, 20.12.5, 21.0.0, 21.0.1 y 21.0.2, contiene una vulnerabilidad que podría permitir a un usuario obtener información confidencial debido a una información correctamente enmascarada en la interfaz de usuario del centro de control. IBM X-Force ID: 227294 (string)

}

]

id : CVE-2022-30607 (string)

lastModified : 2024-11-21T07:03:01.047 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 1.4 (number)

source : psirt@us.ibm.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-06-17T16:15:08.617 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/pages/node/6595759 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/227294 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/pages/node/6595759 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object