Cyber Resilience

CVE-2022-38710

Medium

Published: 03 November 2022

Published
03 November 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0016 37.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-38710 is a medium-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Ibm Robotic Process Automation. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ibm
robotic process automation
≤ 21.0.3
ibm
robotic process automation as a service
≤ 21.0.3
ibm
robotic process automation for cloud pak
≤ 21.0.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-497

Ongoing reviews detect and remove sensitive system information before it reaches publicly accessible systems.

addresses: CWE-497

Employs detection to prevent unauthorized mining of sensitive system information from being exfiltrated to external control spheres.

addresses: CWE-312

Training on secure data handling discourages cleartext storage of sensitive information.

addresses: CWE-497

Documenting where system information is processed and stored prevents exposure to unauthorized control spheres.

addresses: CWE-312

Data action mapping can detect storage actions that leave sensitive information in cleartext.

addresses: CWE-312

Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.

addresses: CWE-312

Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.

addresses: CWE-497

The control stops sensitive system information from crossing into unauthorized control spheres through EM emanations.

References