CVE-2024-1606 - CVE House

Back to Database

Status published Medium CVE-2024-1606

HTML injection in BMC Control-M

4.6 CVSS

Vulnerability Description

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1606

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Maksymilian Kubiak [Afine Team]
Dawid Małecki [Afine Team]

References

More from BMC

View All →

BMC Control-M/Agent memory corruption in SSL/TLS communication

BMC Control-M/Agent buffer overflow in SSL/TLS communication

BMC Control-M/Agent buffer overflow local privilege escalation

BMC Control-M/Agent path traversal local privilege escalation

BMC Control-M/Agent improper IP address filtering order

Affected Vendor

BMC

View all reports →

Affected Software

Control-M

Vulnerable Versions:

9.0.20, 9.0.21

Timeline

Official Publish: March 18th, 2024

Last Modified: August 27th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059 Command and Scripting Interpreter

T1552 Unsecured Credentials

Credential Access

T1071 Application Layer Protocol

Command and Control

T1565 Data Manipulation