CVE-2023-22863: IBM Robotic Process Automation information disclosure

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-18 · updated 2026-06-17
Weakness: CWE-319

Description

IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109.

Affected products

IBM Robotic Process Automation: before 21.0.3 — fixed in 21.0.3
IBM Robotic Process Automation as a Service: before 21.0.3 — fixed in 21.0.3
IBM Robotic Process Automation for Cloud Pak: before 21.0.3 — fixed in 21.0.3

How to fix

Upgrade to a fixed version: IBM Robotic Process Automation 21.0.3; IBM Robotic Process Automation as a Service 21.0.3; IBM Robotic Process Automation for Cloud Pak 21.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22863 or the next vulnerability affects your stack