CERT-PLVULNRICHMENT:CVE-2024-1604CVE-2024-1604 Incorrect authorization in BMC Control-M
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.
Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:bmc:control-m:*:*:*:*:*:*:*:*"
],
"vendor": "bmc",
"product": "control-m",
"versions": [
{
"status": "affected",
"version": "9.0.20",
"lessThan": "9.0.20.238",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.0.21",
"lessThan": "9.0.21.201",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
no
Technical Impact
total