IBM RPA 21.023.0 Privilege Escalation via Clientside Validation
CVE-2024-49824 Published on January 18, 2025

IBM Robotic Process Automation security bypass
IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement.

NVD

Vulnerability Analysis

CVE-2024-49824 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Client-Side Enforcement of Server-Side Security

The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.


Products Associated with CVE-2024-49824

stack.watch emails you whenever new vulnerabilities are published in IBM Robotic Process Automation or IBM Robotic Process Automation Cloud Pak. Just hit a watch button to start following.

IBM Robotic Process Automation
 
IBM Robotic Process Automation Cloud Pak
 

Affected Versions

IBM Robotic Process Automation: IBM Robotic Process Automation for Cloud Pak:

Exploit Probability

EPSS
0.11%
Percentile
29.78%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.