PT-2024-25856 · Bmc · Bmc Remedy Mid Tier

Gabriele Duchi + 3 · Published 2024-09-18 · Updated 2025-10-14 · CVE-2024-34399

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 7.6.04

Description An issue was discovered that allows an unauthenticated remote attacker to access any user account without using a password. This issue affects products that are no longer supported by the maintainer.

Recommendations For BMC Remedy Mid Tier version 7.6.04, consider disabling remote access or restricting user account access until a resolution can be determined, however, since this version is no longer supported, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-34399

Affected Products

Bmc Remedy Mid Tier

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-34399 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34399 · Vendor Advisory
• https://gruppotim.it/it/footer/red-team.html · Note
• https://twitter.com/CVEnew/status/1836534074946556357 · Twitter Post
• https://t.me/cveNotify/138616 · Telegram Post
• https://t.me/cvedetector/6008 · Telegram Post