PT-2025-16242 · Ibm · Ibm Robotic Process Automation For Cloud Pak+1

Published 2025-04-14 · Updated 2025-08-19 · CVE-2024-49825

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.20 IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.20

Description: The issue arises because the system does not invalidate a session after a user logs out, potentially allowing an authenticated user to impersonate another user on the system.

Recommendations: For versions 21.0.0 through 21.0.7.20, update to a version that includes a fix for the session invalidation issue. For versions 23.0.0 through 23.0.20, update to a version that includes a fix for the session invalidation issue. As a temporary workaround, consider implementing additional authentication checks to minimize the risk of impersonation until a patch is available.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-49825

Affected Products

Ibm Robotic Process Automation

Ibm Robotic Process Automation For Cloud Pak

References · 8

• https://osv.dev/vulnerability/CVE-2024-49825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49825 · Security Note
• https://t.me/cveNotify/132811 · Telegram Post
• https://t.me/cvetracker/21539 · Telegram Post
• https://t.me/cvedetector/22877 · Telegram Post
• https://ibm.com/support/pages/node/7230848 · Vendor Advisory, Patch
• https://twitter.com/VulmonFeeds/status/1911835091782840331 · Twitter Post
• https://twitter.com/CVEnew/status/1911800778953728310 · Twitter Post