CVE-2017-17674
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
Risk Assessment
The organization is at risk of information disclosure about its infrastructure, internal network scanning, and potential remote code execution leading to full server compromise.
Recommendation
Immediately upgrade BMC Remedy Mid Tier to a version later than 9.1SP3 that includes a fix for the file inclusion vulnerability.
Original NVD description (English source)
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).