Executive Summary

This vulnerability exists in BMC Control-M/MFT versions 9.0.20 through 9.0.22. It involves a set of default debug user credentials that are hardcoded in cleartext within the application package. Because these credentials are embedded and not protected, if they are not changed by the user, an attacker can easily obtain them.

With these credentials, unauthorized users may gain access to the MFT API debug interface, which is intended for debugging purposes and not for general access.

Useful 0 Not Useful 0

Impact Analysis

If the default debug credentials are left unchanged, an attacker can use them to access the MFT API debug interface without authorization.

This unauthorized access could lead to potential exposure of sensitive information, manipulation of the system, or disruption of services that rely on the MFT API.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves hardcoded default debug user credentials in cleartext, which if left unchanged, can allow unauthorized access to the MFT API debug interface.

Such unauthorized access risks exposing sensitive data or system controls, potentially leading to violations of data protection standards and regulations such as GDPR and HIPAA that require strict access controls and protection of personal and health information.

Therefore, this vulnerability could negatively impact compliance with these regulations if exploited, due to insufficient authentication and potential unauthorized data access.

Useful 0 Not Useful 0