CVE-2024-1606CWE-80

HTML injection in BMC Control-M

Medium · published March 18, 2024

CVSS v3.1
4.6
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-03-18T10:00Z
EPSS history
Timeline
  • 18 MAR 10:00Z
    HTML injection in BMC Control-M
    cvelistv5