PatchTheCVEorchestrator vulnerabilities and fixes
Recent CVEs affecting orchestrator, with upgrade or downgrade steps. 3 tracked.
orchestrator has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-03-03. Highest priority: CVE-2018-17305 (score 49/100).
- CVE-2021-27940 MEDIUM 6.1 UPGRADE resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg p
- CVE-2018-19855 MEDIUM 5.5 UPGRADE UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and T
- CVE-2018-17305 HIGH 8.8 UPGRADE UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary user
FAQ
How do I fix orchestrator vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is orchestrator being exploited right now?
None of the tracked orchestrator CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which orchestrator CVE should I patch first?
CVE-2018-17305 currently ranks highest (49/100): UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary user.