Vulnerability Details CVE-2024-1605
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges.
Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.2%
CVSS Severity
CVSS v3 Score 6.6
References
Products affected by CVE-2024-1605
-
cpe:2.3:a:bmc:control-m:9.0.20
-
cpe:2.3:a:bmc:control-m:9.0.20.214
-
cpe:2.3:a:bmc:control-m:9.0.21
-
cpe:2.3:a:bmc:control-m:9.0.21.001
-
cpe:2.3:a:bmc:control-m:9.0.21.100
-
cpe:2.3:a:bmc:control-m:9.0.21.101
-
cpe:2.3:a:bmc:control-m:9.0.21.102
-
cpe:2.3:a:bmc:control-m:9.0.21.200