CVE-2024-1606: 
Control-M vulnerability analysis and mitigation

A vulnerability identified as CVE-2024-1606 affects BMC Control-M branches 9.0.20 and 9.0.21. The vulnerability stems from a lack of input sanitization that allows logged-in users to manipulate generated web pages through HTML code injection. The issue was discovered and reported to CERT Polska, with fixes released in versions 9.0.20.238 and 9.0.21.200 respectively (CERT.PL).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). It has been assigned a CVSS v3.1 base score of 4.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (NVD).

The vulnerability could lead to successful phishing attacks by allowing attackers to trick users into following hyperlinks pointing to attacker-controlled websites. The CVSS scoring indicates potential low-level impacts on both confidentiality and integrity of the system (CERT.PL).

The vulnerability requires an authenticated user account to exploit, as it affects functionality accessible only to logged-in users. The attack vector involves the manipulation of generated web pages through HTML code injection (NVD).

BMC has released fixes for both affected branches: version 9.0.20.238 for the 9.0.20 branch and version 9.0.21.200 for the 9.0.21 branch. Users are advised to upgrade to these patched versions to mitigate the vulnerability (CERT.PL).