An issue was discovered in BMC Control-M 9.0.21.300. When... · CVE-2025-48709 · GitHub Advisory Database · GitHub

An issue was discovered in BMC Control-M 9.0.21.300. When...

Critical severity Unreviewed Published Aug 7, 2025 to the GitHub Advisory Database • Updated Dec 2, 2025

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

An issue was discovered in BMC Control-M 9.0.21.300. When Control-M Server has a database connection, it runs DBUStatus.exe frequently, which then calls dbu_connection_details.vbs with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations.

References

Published by the National Vulnerability Database

Aug 7, 2025

Published to the GitHub Advisory Database Aug 7, 2025

Last updated Dec 2, 2025

Weaknesses

CWE-214

Invocation of Process Using Visible Sensitive Information

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system. Learn more on MITRE.

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Learn more on MITRE.