CVE-2024-51456 - Vulnerability Details

Vendors	Products
Ibm	Robotic Process Automation
Microsoft	Windows

Link	Providers
https://www.ibm.com/support/pages/node/7180685

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft windows
Weaknesses		CWE-327
CPEs		cpe:2.3:a:ibm:robotic_process_automation:::::::: cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Microsoft Microsoft windows

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.
Title		IBM Robotic Process Automation information disclosure
First Time appeared		Ibm Ibm robotic Process Automation
Weaknesses		CWE-780
CPEs		cpe:2.3:a:ibm:robotic_process_automation:21.0.1:::::::* cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:::::::* cpe:2.3:a:ibm:robotic_process_automation:23.0.0:::::::* cpe:2.3:a:ibm:robotic_process_automation:23.0.19:::::::*
Vendors & Products		Ibm Ibm robotic Process Automation
References		https://www.ibm.com/support/pages/node/7180685
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51456", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-10-28T10:49:59.193Z", "datePublished": "2025-01-12T13:26:34.770Z", "dateUpdated": "2025-01-13T15:15:57.927Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Robotic Process Automation", "vendor": "IBM", "versions": [{"lessThanOrEqual": "21.0.7.19", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThanOrEqual": "23.0.19", "status": "affected", "version": "23.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks."}], "value": "IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-780", "description": "CWE-780 Use of RSA Algorithm without OAEP", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-01-12T13:27:51.724Z"}, "references": [{"url": "https://www.ibm.com/support/pages/node/7180685"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Robotic Process Automation information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-13T15:15:46.277794Z", "id": "CVE-2024-51456", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-13T15:15:57.927Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-51456 (string)

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

state : PUBLISHED (string)

assignerShortName : ibm (string)

dateReserved : 2024-10-28T10:49:59.193Z (string)

datePublished : 2025-01-12T13:26:34.770Z (string)

dateUpdated : 2025-01-13T15:15:57.927Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:* (string)

1 : cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

product : Robotic Process Automation (string)

vendor : IBM (string)

versions : [ »

0 : { »

lessThanOrEqual : 21.0.7.19 (string)

status : affected (string)

version : 21.0.0 (string)

versionType : semver (string)

}

1 : { »

lessThanOrEqual : 23.0.19 (string)

status : affected (string)

version : 23.0.0 (string)

versionType : semver (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. (string)

}

]

value : IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-780 (string)

description : CWE-780 Use of RSA Algorithm without OAEP (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

dateUpdated : 2025-01-12T13:27:51.724Z (string)

}

references : [ »

0 : { »

url : https://www.ibm.com/support/pages/node/7180685 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : IBM Robotic Process Automation information disclosure (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-01-13T15:15:46.277794Z (string)

id : CVE-2024-51456 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-01-13T15:15:57.927Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "IBM Robotic Process Automation information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Robotic Process Automation", "versions": [{"status": "affected", "version": "21.0.0", "versionType": "semver", "lessThanOrEqual": "21.0.7.19"}, {"status": "affected", "version": "23.0.0", "versionType": "semver", "lessThanOrEqual": "23.0.19"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7180685"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.", "supportingMedia": [{"type": "text/html", "value": "IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-780", "description": "CWE-780 Use of RSA Algorithm without OAEP"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-01-12T13:27:51.724Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-51456", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-13T15:15:46.277794Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-01-13T15:15:52.804Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-51456", "state": "PUBLISHED", "dateUpdated": "2025-01-12T13:27:51.724Z", "dateReserved": "2024-10-28T10:49:59.193Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-01-12T13:26:34.770Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

cna : { »

title : IBM Robotic Process Automation information disclosure (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:* (string)

1 : cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:* (string)

]

vendor : IBM (string)

product : Robotic Process Automation (string)

versions : [ »

0 : { »

status : affected (string)

version : 21.0.0 (string)

versionType : semver (string)

lessThanOrEqual : 21.0.7.19 (string)

}

1 : { »

status : affected (string)

version : 23.0.0 (string)

versionType : semver (string)

lessThanOrEqual : 23.0.19 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.ibm.com/support/pages/node/7180685 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-780 (string)

description : CWE-780 Use of RSA Algorithm without OAEP (string)

}

]

}

]

providerMetadata : { »

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

dateUpdated : 2025-01-12T13:27:51.724Z (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-51456 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-01-13T15:15:46.277794Z (string)

}

]

providerMetadata : { »

shortName : CISA-ADP (string)

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

dateUpdated : 2025-01-13T15:15:52.804Z (string)

}

]

}

cveMetadata : { »

cveId : CVE-2024-51456 (string)

state : PUBLISHED (string)

dateUpdated : 2025-01-12T13:27:51.724Z (string)

dateReserved : 2024-10-28T10:49:59.193Z (string)

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

datePublished : 2025-01-12T13:26:34.770Z (string)

assignerShortName : ibm (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "B56D765A-C45B-4F21-A5D1-72C1645DC962", "versionEndIncluding": "21.0.7.19", "versionStartIncluding": "21.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "67F2015A-B4E2-48DB-BECB-A72709115BA7", "versionEndIncluding": "23.0.19", "versionStartIncluding": "23.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks."}, {"lang": "es", "value": "IBM Robotic Process Automation 21.0.0 a 21.0.7.19 y 23.0.0 a 23.0.19 podr\u00edan permitir que un atacante remoto obtenga datos confidenciales que pueden quedar expuestos a trav\u00e9s de ciertos ataques criptoanal\u00edticos."}], "id": "CVE-2024-51456", "lastModified": "2025-03-28T19:19:43.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2025-01-12T14:15:06.550", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7180685"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-780"}], "source": "psirt@us.ibm.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-327"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B56D765A-C45B-4F21-A5D1-72C1645DC962 (string)

versionEndIncluding : 21.0.7.19 (string)

versionStartIncluding : 21.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 67F2015A-B4E2-48DB-BECB-A72709115BA7 (string)

versionEndIncluding : 23.0.19 (string)

versionStartIncluding : 23.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2572D17-1DE6-457B-99CC-64AFD54487EA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. (string)

}

1 : { »

lang : es (string)

value : IBM Robotic Process Automation 21.0.0 a 21.0.7.19 y 23.0.0 a 23.0.19 podrían permitir que un atacante remoto obtenga datos confidenciales que pueden quedar expuestos a través de ciertos ataques criptoanalíticos. (string)

}

]

id : CVE-2024-51456 (string)

lastModified : 2025-03-28T19:19:43.600 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.6 (number)

source : psirt@us.ibm.com (string)

type : Primary (string)

}

]

}

published : 2025-01-12T14:15:06.550 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.ibm.com/support/pages/node/7180685 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-780 (string)

}

]

source : psirt@us.ibm.com (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-327 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object