Control-m/managed File Transfer vulnerabilities
3 known vulnerabilities in Control-m/managed File Transfer from BMC. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Control-m/managed File Transfer: Use of Hard-coded Credentials
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access
- 7.5 High severity
Control-m/managed File Transfer: Improper Access Control
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API
- 8.8 High severity
Control-m/managed File Transfer: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Su