CVE-2023-35900: IBM Robotic Process Automation information disclosure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-19 · updated 2026-06-17
Weakness: CWE-200

Description

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may be used to determine software vulnerabilities at the operating system level. IBM X-Force ID: 259368.

Affected products

IBM Robotic Process Automation: through 21.0.7.4; from 23.0.0 through 23.0.5
IBM Robotic Process Automation as a Service: through 21.0.7.4; from 23.0.0 through 23.0.5
IBM Robotic Process Automation for Cloud Pak: through 21.0.7.4; from 23.0.0 through 23.0.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/259368
https://www.ibm.com/support/pages/node/7010895
https://exchange.xforce.ibmcloud.com/vulnerabilities/259368
https://www.ibm.com/support/pages/node/7010895

Get alerted when CVE-2023-35900 or the next vulnerability affects your stack