CVE-2024-1606

Name of the Vulnerable Software and Affected Versions BMC Control-M versions 9.0.20 through 9.0.21

Description The issue is related to a lack of input sanitization, allowing logged-in users to manipulate generated web pages via injection of HTML code. This could lead to a successful phishing attack, for example, by tricking users into using a hyperlink pointing to a website controlled by an attacker.

Recommendations For version 9.0.20, update to version 9.0.20.238 to resolve the issue. For version 9.0.21, update to version 9.0.21.200 to resolve the issue. As a temporary workaround, consider restricting access to generated web pages to minimize the risk of exploitation.