Description (CNA)
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| BMC / Control-M/Agent | affected 9.0.22; affected 9.0.21; affected 9.0.20; affected 9.0.19; affected 9.0.18 |
CWE
CWE-306
References
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271
ADP enrichment
No English description supplied.
No references supplied.