PT-2024-10346 · Ibm · Ibm Robotic Process Automation For Cloud Pak+1

Ramandeep Kaur

·

Published

2024-10-20

·

Updated

2025-08-18

·

CVE-2024-49824

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.7.18 IBM Robotic Process Automation versions 23.0.0 through 23.0.18 IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.18 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.18
Description The issue is related to improper validation of client-side security enforcement, which could allow an authenticated user to perform unauthorized actions as a privileged user. This can be exploited by a remote attacker to elevate their privileges.
Recommendations For IBM Robotic Process Automation versions 21.0.0 through 21.0.7.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation versions 23.0.0 through 23.0.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.18, update to a version that properly validates client-side security enforcement. For IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.18, update to a version that properly validates client-side security enforcement. As a temporary workaround, consider restricting access to privileged user actions until a patch is available.

Fix

Weakness Enumeration

CWE-602

Related Identifiers

BDU:2025-00846
CVE-2024-49824

Affected Products

Ibm Robotic Process Automation
Ibm Robotic Process Automation For Cloud Pak