CVE-2024-6922CWE-918

Server-Side Request Forgery in Automation 360

Medium · published July 26, 2024

CVSS v4.0
6.9
EPSS
30%
Percentile
98.2
In the wild
Unconfirmed
What it is

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.30172 · 98.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-07-26T13:52Z
EPSS history
Timeline
  • 26 JUL 13:52Z
    Server-Side Request Forgery in Automation 360
    cvelistv5