« Volver al listado

CVE-2024-49825

Estado: AnalizadaMedia (4.3)—

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — Robotic Process AutomationIBM — Robotic Process Automation FOR Cloud PAK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-49825",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-49825",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-14T15:03:12.570664Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation:21.0.7.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation:23.0.20:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Robotic Process Automation",
          "versions": [
            {
              "status": "affected",
              "version": "21.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "21.0.7.20"
            },
            {
              "status": "affected",
              "version": "23.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "23.0.20"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.7.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:23.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:23.0.20:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Robotic Process Automation for Cloud Pak",
          "versions": [
            {
              "status": "affected",
              "version": "21.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "21.0.7.20"
            },
            {
              "status": "affected",
              "version": "23.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "23.0.20"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-14T15:15:23.627",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7230848",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system."
    },
    {
      "lang": "es",
      "value": "IBM Robotic Process Automation y Robotic Process Automation for Cloud Pak 21.0.0 a 21.0.7.20 y 23.0.0 a 23.0.20 no invalidan la sesión después de un cierre de sesión, lo que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema."
    }
  ],
  "lastModified": "2026-06-17T08:00:29.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3EEE811-3B5E-44B2-899F-5C1B254EF8EB",
              "versionEndIncluding": "21.0.7.20",
              "versionStartIncluding": "21.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB744E16-DA07-40B4-85F5-224FF0C16862",
              "versionEndIncluding": "23.0.20",
              "versionStartIncluding": "23.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F02A0C81-4F18-45E2-B1CD-C86808352FF1",
              "versionEndIncluding": "21.0.7.20",
              "versionStartIncluding": "21.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F6CCD93-EEB1-447F-86DC-473445303C69",
              "versionEndIncluding": "23.0.20",
              "versionStartIncluding": "23.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}