CVE-2024-6922

Server-Side Request Forgery in Automation 360

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Affected

Automationanywhere · Automation 360

CVSS v4.0 RAPID7

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

30.17% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high

Published

2024-07-26

Updated

2024-08-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6922.yaml

References

• CVE Record
• NVD entry