CVE-2017-17678
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
BMC Remedy Mid Tier 9.1SP3 is affected by a DOM-based cross-site scripting (XSS) vulnerability in a legacy utility. This allows an attacker to inject malicious client-side scripts.
Risk Assessment
An attacker could exploit this vulnerability to steal user sessions, intercept data, or perform unauthorized actions on behalf of the victim.
Recommendation
Immediately update BMC Remedy Mid Tier to a patched version or apply the available security fixes.
Other vulnerabilities in BMC Remedy Mid Tier
See all- CVE-2017-17674Critical
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
- CVE-2017-17675Medium
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing an attacker to hijack system logs. This data can include user names and HTTP data.
Original NVD description (English source)
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS