PT-2021-8569 · Bmc · Bmc Remedy

Kristian Varnai + 1 · Published 2021-05-19 · Updated 2021-06-01 · CVE-2017-17677

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Remedy version 9.1SP3

Description The issue allows authenticated code execution. Authenticated users with the right to create reports can utilize BIRT templates to execute code.

Recommendations For BMC Remedy version 9.1SP3, consider restricting access to report creation and BIRT template usage to minimize the risk of exploitation until a fix is available. As a temporary workaround, limiting the privileges of authenticated users may help reduce the potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-17677

Affected Products

Bmc Remedy

References · 7

• https://osv.dev/vulnerability/CVE-2017-17677 · Vendor Advisory
• https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17677 · Security Note
• https://t.me/cvenotify/14650 · Telegram Post
• https://seclists.org/fulldisclosure/2017/Oct/52 · Note
• http://bmc.com · Note
• http://remedy.com · Note