2 lines
4.3 KiB
JSON
2 lines
4.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Control-M","vendor":"BMC","versions":[{"lessThan":"9.0.20.238","status":"affected","version":"9.0.20","versionType":"custom"},{"lessThan":"9.0.21.200","status":"affected","version":"9.0.21","versionType":"custom"}]}],"source":"cvd@cert.pl"},{"affectedData":[{"cpes":["cpe:2.3:a:bmc:control-m:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"control-m","vendor":"bmc","versions":[{"lessThan":"9.0.20.238","status":"affected","version":"9.0.20","versionType":"custom"},{"lessThan":"9.0.21.200","status":"affected","version":"9.0.21","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:bmc:control-m:*:*:*:*:*:*:*:*","matchCriteriaId":"87B57AF2-7AB2-48C3-A85B-A918033C70AF","versionEndExcluding":"9.0.20.238","versionStartIncluding":"9.0.20","vulnerable":true},{"criteria":"cpe:2.3:a:bmc:control-m:*:*:*:*:*:*:*:*","matchCriteriaId":"8F86D69B-93E8-42A3-8D24-CDB59F33A388","versionEndExcluding":"9.0.21.201","versionStartIncluding":"9.0.21","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker.\n\nFix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200. \n\n"},{"lang":"es","value":"La falta de sanitización de entradas en las ramas 9.0.20 y 9.0.21 de BMC Control-M permite a los usuarios registrados manipular las páginas web generadas mediante la inyección de código HTML. Esto podría conducir a un ataque de phishing exitoso, por ejemplo, engañando a los usuarios para que utilicen un hipervínculo que apunte a un sitio web controlado por un atacante. La solución para la rama 9.0.20 se lanzó en la versión 9.0.20.238. La solución para la rama 9.0.21 se lanzó en la versión 9.0.21.200."}],"id":"CVE-2024-1606","lastModified":"2026-06-17T07:04:37.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"cvd@cert.pl","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1606","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-03-19T15:51:58.875820Z","version":"2.0.3"}}]},"published":"2024-03-18T10:15:20.863","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2024/03/CVE-2024-1604"},{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/posts/2024/03/CVE-2024-1604"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://www.bmc.com/it-solutions/control-m.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2024/03/CVE-2024-1604"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://cert.pl/posts/2024/03/CVE-2024-1604"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://www.bmc.com/it-solutions/control-m.html"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"cvd@cert.pl","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|