The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password…
[email protected]·CWE-328·Published 2026-07-01
The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions
The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions
El Control-M/Enterprise Manager utiliza protecciones débiles para los hashes almacenados de las contraseñas de las cuentas, lo que podría permitir ataques de recuperación de contraseñas sin conexión si un atacante obtiene los datos de las credenciales. Esta vulnerabilidad afecta a Control-M/Enterprise Manager versiones no compatibles 9.0.20.x y, potencialmente, a versiones anteriores no compatibles.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 5.6 | — | — | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | Secondary | NVD | 5.6 | 0.8 | 4.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
| 4.0 | Primary | cve.org | 5.6 | — | — | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 4.0 | Secondary | NVD | 5.6 | — | — | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 4.0 | Secondary | ENISA EUVD | 5.6 | — | — | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |