CVE-2023-38734

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
IBM	Robotic Process Automation	>= 21.0.0, <= 21.0.7.1; >= 23.0.0, <= 23.0.1
ibm	robotic_process_automation	>= 21.0.0, <= 21.0.7.1; >= 23.0.0, <= 23.0.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/262481VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7028227Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/262481VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7028227Patch, Vendor Advisory

Timeline

Published: Aug 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-387356.5IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabb CVE-2023-387367.8IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege CVE-2023-387377.5IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-craf CVE-2023-387388.1IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If CVE-2023-387398.8IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allo CVE-2023-38747.5A vulnerability, which was classified as critical, was found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown functio CVE-2023-387407.5IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL st CVE-2023-387417.5IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on ind CVE-2023-387437.2Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.CVE-2023-387447.5Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of CVE-2023-387456.3Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating fil CVE-2023-387467.8Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open