CVE-2024-1604: 
Control-M vulnerability analysis and mitigation

CVE-2024-1604 is a security vulnerability affecting BMC Control-M branches 9.0.20 and 9.0.21, discovered and disclosed on March 18, 2024. The vulnerability stems from improper authorization in the report management and creation module, which allows logged-in users to read and make unauthorized changes to any reports within the application, even without proper permissions (NVD).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The attack requires the attacker to know the unique identifier of the report they want to manipulate. The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating network accessibility with high attack complexity, requiring low privileges and user interaction (NVD).

When exploited, this vulnerability allows unauthorized users to access and modify reports within the BMC Control-M application that they should not have permission to interact with. This could lead to unauthorized access to sensitive information and potential manipulation of report data (NVD).

The vulnerability requires an authenticated user with knowledge of specific report identifiers to exploit. The attack complexity is considered high, and user interaction is required for successful exploitation (NVD).

BMC has released fixes for both affected versions. For the 9.0.20 branch, the fix was released in version 9.0.20.238, and for the 9.0.21 branch, the fix was released in version 9.0.21.201. Users are advised to upgrade to these patched versions to mitigate the vulnerability (NVD).