CVE-2022-36115

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for unintended functionality. An attacker can abuse the CreateProcessAutosave() method to inject their own functionality into a development process. If (upon a warning) a user decides to recover unsaved work by using the last saved version, the malicious code could enter the workflow. Should the process action stages not be fully reviewed before publishing, this could result in the malicious code being run in a production environment.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blueprism.comProduct
https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterpriseVendor Advisory
https://portal.blueprism.com/security-vulnerabilities-august-2022Permissions Required, Vendor Advisory
https://blueprism.comProduct
https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterpriseVendor Advisory
https://portal.blueprism.com/security-vulnerabilities-august-2022Permissions Required, Vendor Advisory

Timeline

Published: Aug 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-361165.3An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361173.1An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361185.3An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361198.8An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361208.1An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361215.3An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application se CVE-2022-361227.8The Automox Agent before 40 on Windows incorrectly sets permissions on key files.CVE-2022-361237.8The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to c CVE-2022-361247.5It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affect CVE-2022-361257.5It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache A CVE-2022-361267.2An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attack CVE-2022-361277.5A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed