CVE-2024-6922
Medium
Description
Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.
SeverityMedium
CVSS6.9
Exploit probability—
ProductAutomation 360
PublishedJul 26, 2024
First seenJul 26, 2024
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Automationanywhere Automation 360 | 21 ≤ v ≤ 32 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.