CVE-2017-17675
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing an attacker to hijack system logs. This data can include user names and HTTP data.
Risk Assessment
The risk involves leakage of sensitive information such as user names and HTTP data, which could lead to privacy breaches and further attacks on the system.
Recommendation
It is recommended to immediately restrict access to remote logs by implementing authentication and updating to the latest version of BMC Remedy Mid Tier.
Other vulnerabilities in BMC Remedy Mid Tier
See all- CVE-2017-17674Critical
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
- CVE-2017-17678Medium
BMC Remedy Mid Tier 9.1SP3 is affected by a DOM-based cross-site scripting (XSS) vulnerability in a legacy utility. This allows an attacker to inject malicious client-side scripts.
Original NVD description (English source)
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS