CVE-2018-1547

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651.

CVSS v3 7.7 HIGH
CVSS v2.0 5.1 MEDIUM

7.7^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg22016197	Patch Vendor Advisory
http://www.securityfocus.com/bid/104469	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/142651	VDB Entry Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:robotic_process_automation_with_automation_anywhere:10.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-07 14:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-1547

Mitre link : CVE-2018-1547

CVE.ORG link : CVE-2018-1547

JSON object : View

Products Affected

ibm

robotic_process_automation_with_automation_anywhere

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-1547", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2018-06-07T14:29:00.313", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg22016197", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/104469", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142651", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651."}, {"lang": "es", "value": "IBM Robotic Process Automation with Automation Anywhere 10.0 podr\u00eda permitir que un atacante remoto ejecute c\u00f3digo arbitrario en el sistema, provocado por el cifrado de salida incorrecto en un archivo CSV exportado. Si se convence a una v\u00edctima para que descargue el archivo CSV exportado, lo abra en Microsoft Excel y confirme las dos preguntas de seguridad, un atacante podr\u00eda explotar esta vulnerabilidad para ejecutar cualquier comando o programa en la m\u00e1quina de la v\u00edctima. IBM X-Force ID: 142651."}], "lastModified": "2019-10-09T23:38:37.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:robotic_process_automation_with_automation_anywhere:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70CDC4BC-3923-44B1-B173-E43523A978F1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}