← Back

CVE-2024-49825

nvd nist
Published: Apr 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

Affected (4)

Ibm
2 products
Robotic Process Automation
Robotic Process Automation For Cloud Pak
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Robotic Process Automation
From 21.0.0 to 21.0.7.20
Robotic Process Automation
From 23.0.0 to 23.0.20
Ibm
Robotic Process Automation For Cloud Pak
From 21.0.0 to 21.0.7.20
Robotic Process Automation For Cloud Pak
From 23.0.0 to 23.0.20

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.