PT-2023-10647 · Bmc · Bmc Server Automation

Published 2023-09-05 · Updated 2023-09-09 · CVE-2017-9453

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Server Automation versions prior to 8.9.01 patch 1

Description The issue allows for Process Spawner command execution due to an authentication bypass.

Recommendations For versions prior to 8.9.01 patch 1, apply patch 1 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-9453

Affected Products

Bmc Server Automation

References · 4

• https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9453-1020706453.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9453 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9453 · Vendor Advisory
• https://t.me/cibsecurity/69881 · Telegram Post