Session Management Flaw in IBM Robotic Process Automation Products
CVE-2024-49825

6.3MEDIUM

Key Information:

Vendor
IBM
Status
Robotic Process Automation
Robotic Process Automation For Cloud Pak
Vendor
CVE Published:
14 April 2025

Summary

A session management vulnerability exists in IBM Robotic Process Automation and its Cloud Pak variant, affecting versions 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20. This issue arises because the system fails to properly invalidate user sessions after logout, potentially allowing any authenticated user to access another user's session. As a result, unauthorized actions may be performed by an impersonating user, leading to significant security risks.

Affected Version(s)

Robotic Process Automation 21.0.0 <= 21.0.7.20

Robotic Process Automation 23.0.0 <= 23.0.20

Robotic Process Automation for Cloud Pak 21.0.0 <= 21.0.7.20

References

https://www.ibm.com/support/pages/node/7230848
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.