PT-2014-8443 · Bmc · Bmc Track-It!

Brandon Perry · Published 2014-12-09 · Updated 2023-08-02 · CVE-2014-8270

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BMC Track-It! version 11.3

Description The issue allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a local system account, then performing a password reset. This is related to a credential information disclosure vulnerability in the web account component.

Recommendations For version 11.3, consider restricting access to the password reset functionality until a fix is available, and avoid creating accounts with names that match local system accounts to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8270

ZDI-14-419

Affected Products

Bmc Track-It!

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/bmc_trackit_passwd_reset.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8270 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-419 · Security Note
• http://support.numarasoftware.com/support/articles.asp?how=%20AND%20&mode=detail&kcriteria=7508&ID=7654 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-14-419 · Note