BMC Control-M/MFT Hardcoded Default Debug User Credentials Vulnerability

A vulnerability exists in BMC Control-M/MFT versions 9.0.20 through 9.0.22, where default debug user credentials are hardcoded in cleartext within the application package. If these credentials are not changed, they can be easily accessed, potentially allowing unauthorized access to the MFT API debug interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the MFT API debug interface.

Remediation

Users can upgrade to BMC Control-M/MFT patch PAAFP.9.0.22.025 to address this vulnerability. Instructions for installing this patch are available in the BMC Control-M documentation.