7.8

CVE-2024-1605

DLL side-loading in BMC Control-M

BMC Control-M  branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL)  from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. 





Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bmc ≫ Control-m Version >= 9.0.20 < 9.0.20.238
Bmc ≫ Control-m Version >= 9.0.21 < 9.0.21.201
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.103
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cvd@cert.pl 6.6 1.8 4.7
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://www.bmc.com/it-solutions/control-m.html
Product
https://cert.pl/en/posts/2024/03/CVE-2024-1604
Third Party Advisory
https://cert.pl/posts/2024/03/CVE-2024-1604
Third Party Advisory