CVE-2024-1604 MEDIUM

CVE-2024-1604: Incorrect authorization in BMC Control-M

Vendor Bmc
Product Control-M
Weakness CWE-639 · IDOR
Published March 18, 2024
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

Key dates

02Disclosure timeline

March 18, 2024 CVE published
October 10, 2024 Record updated