Lucene search

CERT-PLCVELIST:CVE-2024-1604

HistoryMar 18, 2024 - 9:59 a.m.

CVE-2024-1604 Incorrect authorization in BMC Control-M

2024-03-1809:59:35

CWE-863

CERT-PL

www.cve.org

cve-2024-1604

bmc control-m

improper authorization

unauthorized changes

report management

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

Percentile

15.5%

JSON

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Control-M",
    "vendor": "BMC",
    "versions": [
      {
        "lessThan": "9.0.20.238",
        "status": "affected",
        "version": "9.0.20",
        "versionType": "custom"
      },
      {
        "lessThan": "9.0.21.201",
        "status": "affected",
        "version": "9.0.21",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/03/CVE-2024-1604

cert.pl/posts/2024/03/CVE-2024-1604

www.bmc.com/it-solutions/control-m.html

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

Percentile

15.5%

JSON

Related for CVELIST:CVE-2024-1604