CVE-2024-1604CWE-639

Incorrect authorization in BMC Control-M

Medium · published March 18, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00491 · 41.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-03-18T09:59Z
EPSS history
Timeline
  • 18 MAR 09:59Z
    Incorrect authorization in BMC Control-M
    cvelistv5