CVE-2024-51448
18.01.2025, 15:15
IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service. A subsequent service or server restart will then run that binary with administrator privilege.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ibm | robotic_process_automation | 21.0.0 ≤ 𝑥 ≤ 21.0.7.17 |
| ibm | robotic_process_automation | 23.0.0 ≤ 𝑥 ≤ 23.0.18 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-277 - Insecure Inherited PermissionsA product defines a set of insecure permissions that are inherited by objects that are created by the program.
- CWE-732 - Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.