IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
2025-04-14T15:15:23.627
2025-08-19T16:49:41.707
Analyzed
CVSSv3.1: 6.3 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | ibm | robotic_process_automation | ≤ 21.0.7.20 | Yes |
| Application | ibm | robotic_process_automation | ≤ 23.0.20 | Yes |
| Application | ibm | robotic_process_automation_for_cloud_pak | ≤ 21.0.7.20 | Yes |
| Application | ibm | robotic_process_automation_for_cloud_pak | ≤ 23.0.20 | Yes |