PT-2020-7852 · Bmc · Bmc Remedy Ar System Server

Published 2020-01-15 · Updated 2020-01-24 · CVE-2015-5071

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: BMC Remedy AR System Server versions prior to 9.0 SP1

Description: The issue allows remote authenticated users to access arbitrary files by manipulating the report parameter of the BIRT viewer servlet in the AR System Mid Tier component.

Recommendations: For versions prior to 9.0 SP1, update to version 9.0 SP1 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2015-5071

Affected Products

Bmc Remedy Ar System Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-5071 · Security Note
• https://packetstormsecurity.com/files/133688/BMC-Remedy-AR-8.1-9.0-File-Inclusion.html · Note
• https://communities.bmc.com/docs/DOC-77816 · Note