CVE-2024-6922 Server-Side Request Forgery in Automation 360

2024-07-2613:52:28

CWE-918

rapid7

www.cve.org

automation 360

server-side request forgery

vulnerability

web api

unauthenticated access

control room

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:L/SI:N/VA:N/SA:N

EPSS

0.001

Percentile

18.9%

JSON

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "API"
    ],
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "Automation 360",
    "vendor": "Automationanywhere",
    "versions": [
      {
        "lessThanOrEqual": "32",
        "status": "affected",
        "version": "21",
        "versionType": "cpe"
      }
    ]
  }
]