PT-2022-10383 · Bmc · Bmc Track-It!

Brandin Perry · Published 2022-01-06 · Updated 2024-05-08 · CVE-2021-35001

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BMC Track-It! (affected versions not specified)

Description This issue allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this issue. The specific flaw exists within the "GetData" endpoint, resulting from the lack of authorization prior to allowing access to functionality. An attacker can leverage this issue to disclose stored credentials, leading to further compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-35001

ZDI-22-001

Affected Products

Bmc Track-It!

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-35001 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35001 · Vendor Advisory
• https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-001 · Security Note
• https://twitter.com/CVEnew/status/1788295936927834482 · Twitter Post