CVE-2023-23476

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes. IBM X-Force ID: 245425.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
IBM	Robotic Process Automation	>= 21.0.0, <= 21.0.7.latest
IBM	Robotic Process Automation for Cloud Pak	>= 21.0.0, <= 21.0.7.latest

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/245425VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7017490Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/245425VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7017490Vendor Advisory

Timeline

Published: Aug 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-234779.8IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specia CVE-2023-23489.8A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some u CVE-2023-234805.4IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2023-234815.4IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to CVE-2023-234829.6IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By pe CVE-2023-234874.3IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID CVE-2023-234889.8The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para CVE-2023-234899.8The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th CVE-2023-23495.4A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown fu CVE-2023-234908.8The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' paramet CVE-2023-234916.1The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' p CVE-2023-234928.8The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' param