CVE-2024-49825

Summary

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

Affected Software

VendorProductVersion RangeStatus
IBMRobotic Process Automation21.0.0 <= 21.0.7.20affected
IBMRobotic Process Automation23.0.0 <= 23.0.20affected
IBMRobotic Process Automation for Cloud Pak21.0.0 <= 21.0.7.20affected
IBMRobotic Process Automation for Cloud Pak23.0.0 <= 23.0.20affected

Weaknesses

  • CWE-613: CWE-613 Insufficient Session Expiration

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References