SQL Injection Vulnerability in BMC Control-M through 9.0.20.200 via /RF-Server/report/deleteReport report-id Parameter

CVE-2023-39122 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.