CVE-2021-35002

HIGH EPSS 73.6%
Published May 7, 20242y ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
High
Find Similar
Published May 7, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14122.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
73.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 7

VendorProductVersionRange
bmctrack-it\!20.19.01any
bmctrack-it\!20.19.02any
bmctrack-it\!20.19.03any
bmctrack-it\!20.20.01any
bmctrack-it\!20.20.02any
bmctrack-it\!20.20.03any
bmctrack-it\!20.21.01any

References 2

  • community.bmc.com https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
    Vendor Advisory
  • zerodayinitiative.com https://www.zerodayinitiative.com/advisories/ZDI-22-002/
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.