CVE-2024-49824

published 2025-01-18

CVE-2024-49824: IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I H A N

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18

could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
ibm	robotic_process_automation	>= 21.0.0 < 21.0.7.19	21.0.7.19
ibm	robotic_process_automation	21.0.0 – 21.0.7.18	—
ibm	robotic_process_automation	>= 23.0.0 < 23.0.19	23.0.19
ibm	robotic_process_automation	23.0.0 – 23.0.18	—
ibm	robotic_process_automation_for_cloud_pak	>= 21.0.0 < 21.0.7.19	21.0.7.19
ibm	robotic_process_automation_for_cloud_pak	21.0.0 – 21.0.7.18	—
ibm	robotic_process_automation_for_cloud_pak	>= 23.0.0 < 23.0.19	23.0.19
ibm	robotic_process_automation_for_cloud_pak	23.0.0 – 23.0.18	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-602