CVE-2024-1604

EUVD-2024-17344
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.







Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CERT-PLCNA
6.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
bmccontrol-m
9.0.20 ≤
𝑥
< 9.0.20.238
bmccontrol-m
9.0.21 ≤
𝑥
< 9.0.21.201
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert.pl/en/posts/2024/03/CVE-2024-1604
https://cert.pl/posts/2024/03/CVE-2024-1604
https://www.bmc.com/it-solutions/control-m.html
https://cert.pl/en/posts/2024/03/CVE-2024-1604
https://cert.pl/posts/2024/03/CVE-2024-1604
https://www.bmc.com/it-solutions/control-m.html