Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

IBM RPA with Automation Anywhere 11 allows LDAP injection

CVE-2019-4297 · published 7 years ago
Summary

The IBM Robotic Process Automation product that includes Automation Anywhere version 11 can be tricked by a signed‑in user into sending specially crafted requests that manipulate the directory service queries. This could let the attacker read or change information stored in the LDAP directory. Apply the vendor’s security update or patch as soon as possible and restrict access to trusted users.

What to do
  • Update ibm robotic_process_automation_with_automation_anywhere to version 11.0.0.5 or later.
Affected software
VendorProductAffected versions
ibm robotic_process_automation_with_automation_anywhere >= 11.0.0.0, < 11.0.0.5
cpe:2.3:a:ibm:robotic_process_automation_with_automation_anywhere:*:*:*:*:*:*:*:*
Original advisory text
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit ...
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Timeline
Published1 Jul 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-4297 · NVD
Track software like this
Free during beta