CVE-2024-1604 - CVE House

Back to Database

Status published Medium CVE-2024-1604

Incorrect authorization in BMC Control-M

6.4 CVSS

Vulnerability Description

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1604

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Maksymilian Kubiak [Afine Team]
Dawid Małecki [Afine Team]

References

More from BMC

View All →

BMC Control-M/Agent memory corruption in SSL/TLS communication

BMC Control-M/Agent buffer overflow in SSL/TLS communication

BMC Control-M/Agent buffer overflow local privilege escalation

BMC Control-M/Agent path traversal local privilege escalation

BMC Control-M/Agent improper IP address filtering order

Affected Vendor

BMC

View all reports →

Affected Software

Control-M

Vulnerable Versions:

9.0.20, 9.0.21

Timeline

Official Publish: March 18th, 2024

Last Modified: October 10th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1213 Data from Information Repositories

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Privilege Escalation