Vulnerability Details CVE-2024-1605
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges.
Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 10.5%
CVSS Severity
CVSS v3 Score 6.6
References
Products affected by CVE-2024-1605
-
cpe:2.3:a:bmc:control-m:9.0.20
-
cpe:2.3:a:bmc:control-m:9.0.20.214
-
cpe:2.3:a:bmc:control-m:9.0.21
-
cpe:2.3:a:bmc:control-m:9.0.21.001
-
cpe:2.3:a:bmc:control-m:9.0.21.100
-
cpe:2.3:a:bmc:control-m:9.0.21.101
-
cpe:2.3:a:bmc:control-m:9.0.21.102
-
cpe:2.3:a:bmc:control-m:9.0.21.200