PT-2021-8567 · Bmc · Bmc Remedy Mid Tier

Kristian Varnai + 1 · Published 2021-05-19 · Updated 2021-05-25 · CVE-2017-17674

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 9.1SP3

Description The system is affected by remote and local file inclusion due to a lack of restrictions on targeted files. This can lead to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).

Recommendations For BMC Remedy Mid Tier version 9.1SP3, consider restricting access to sensitive files and directories to minimize the risk of exploitation. As a temporary workaround, limit the ability to include remote and local files until a patch is available.

Fix

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-17674

Affected Products

Bmc Remedy Mid Tier

References · 7

• https://osv.dev/vulnerability/CVE-2017-17674 · Vendor Advisory
• https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17674 · Security Note
• https://seclists.org/fulldisclosure/2017/Oct/52 · Note
• http://bmc.com · Note
• http://remedy.com · Note
• https://t.me/cvenotify/14652 · Telegram Post