SecuriTricks - CVE-2024-49824

Description

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement.

Product(s) Impacted

Product	Versions
IBM Robotic Process Automation	['21.0.0 - 21.0.7.18', '23.0.0 - 23.0.18']
IBM Robotic Process Automation for Cloud Pak	['21.0.0 - 21.0.7.18', '23.0.0 - 23.0.18']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-602

Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

References

https://www.ibm.com/support/pages/node/7177587

CVSS Score

6.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

View Vector String

Timeline

Published: Jan. 18, 2025, 4:15 p.m.
Last Modified: Jan. 18, 2025, 4:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

CVE-2024-49824