CVE-2024-1604

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.

Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-16057.8BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read CVE-2024-16065.4Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via CVE-2024-16087.5In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application inte CVE-2024-16098.7In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.CVE-2024-16109.8In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.CVE-2024-16187.8A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This CVE-2024-16198.8Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially f CVE-2024-16217.5The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email lo CVE-2024-16227.5Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening CVE-2024-16237.8Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker CVE-2024-16249.4An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPE CVE-2024-16256.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized del