CVE-2022-42442

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
IBMRobotic Process Automation for Cloud Pak21.0.1, 21.0.2, 21.0.3, 21.0.4, 21.0.5

References

Timeline

Published
Nov 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-424439.8An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may alloCVE-2022-424446.5IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged CVE-2022-424454.9HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential pCVE-2022-424466.5Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the CVE-2022-424478.8HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a lCVE-2022-424495.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicaCVE-2022-42454.3A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequenCVE-2022-424505.4Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-424514.4Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged usCVE-2022-424525.4HCL Launch is vulnerable to HTML injection.  HTML code is stored and included without being sanitized. This can lead to further attacks suchCVE-2022-424536.5There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the loCVE-2022-424545.3Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requi