CVE-2025-48709

Katalog CVE

CVSS 7.8 · High EPSS 0,13%

Kerentanan Invocation of Process Using Visible Sensitive Information pada bmc control-m/server. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.

Rincian

Terbit di NVD

7 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-214: Invocation of Process Using Visible Sensitive Information
CWE-532: Insertion of Sensitive Information into Log File
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 1,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9... mitigasi · advisory vendor