CVE-2017-17674
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
Risk Assessment
The organization is at risk of information disclosure about its infrastructure, internal network scanning, and potential remote code execution leading to full server compromise.
Recommendation
Immediately upgrade BMC Remedy Mid Tier to a version later than 9.1SP3 that includes a fix for the file inclusion vulnerability.
Other vulnerabilities in BMC Remedy Mid Tier
See all- CVE-2017-17678Medium
BMC Remedy Mid Tier 9.1SP3 is affected by a DOM-based cross-site scripting (XSS) vulnerability in a legacy utility. This allows an attacker to inject malicious client-side scripts.
- CVE-2017-17675Medium
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing an attacker to hijack system logs. This data can include user names and HTTP data.
Original NVD description (English source)
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).