CVE-2023-39122

CriticalCVSS 9.8

Published: 31/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

BMC Control-M versions up to 9.0.20.200 are vulnerable to SQL injection via the report-id parameter in the /RF-Server/report/deleteReport request. This issue is fixed in version 9.0.21 and also by a patch for version 9.0.20.200.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized access to database information, posing a serious threat to the integrity and confidentiality of organizational data.

Recommendation

It is recommended to upgrade to version 9.0.21 or apply the appropriate patch for version 9.0.20.200 to secure the system against this threat.

Original NVD description (English source)

BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).