CVE-2022-24047: BMC Track-It! HTTP Module Improper Access Control Authentication Bypass Vulnerability

Published Feb 18, 2022

Updated

This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618.

Other sources

This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system.

Affected Software

2 affected components

BMC Track-It!

BMC Track-it\!=20.21.01.102

Event History

Feb 18, 2022

CVE Published

via MITRE·07:51 PM

Data Sourced

via MITRE·07:51 PM

DescriptionSeverityWeakness

Aug 3, 2024

Advisory Published

via ZDI·04:08 AM

Frequently Asked Questions

What is CVE-2022-24047?

CVE-2022-24047 is a vulnerability that allows remote attackers to bypass authentication on BMC Track-It! 20.21.01.102 installations.

How severe is CVE-2022-24047?

CVE-2022-24047 has a severity rating of 9.8, which is considered critical.

How can remote attackers exploit CVE-2022-24047?

Remote attackers can exploit CVE-2022-24047 by bypassing authentication on affected BMC Track-It! installations.

What is the affected software for CVE-2022-24047?

The affected software for CVE-2022-24047 is BMC Track-It! 20.21.01.102.

Is authentication required to exploit CVE-2022-24047?

No, authentication is not required to exploit CVE-2022-24047.