CVE-2022-35864: BMC Track-It! GetPopupSubQueryDetails SQL Injection Information Disclosure Vulnerability
First published: Wed Aug 03 2022(Updated: )
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bmc Track-it\! | =20.19.03 | |
| Bmc Track-it\! | =20.20.01 | |
| Bmc Track-it\! | =20.20.02 | |
| Bmc Track-it\! | =20.20.03 | |
| Bmc Track-it\! | =20.21.01 | |
| Bmc Track-it\! | =20.21.02 | |
| BMC Track-It! |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-35864?
CVE-2022-35864 refers to a SQL Injection Information Disclosure Vulnerability in BMC Track-It! 20.21.02.109.
How severe is CVE-2022-35864?
CVE-2022-35864 has a severity score of 6.5, which is classified as medium.
How can I exploit CVE-2022-35864?
To exploit CVE-2022-35864, remote attackers would need to authenticate and send a crafted SQL query to the GetPopupSubQueryDetails endpoint in BMC Track-It! 20.21.02.109.
What versions of BMC Track-It! are affected by CVE-2022-35864?
CVE-2022-35864 affects BMC Track-It! versions 20.19.03, 20.20.01, 20.20.02, 20.20.03, 20.21.01, and 20.21.02.
How can I fix CVE-2022-35864?
To fix CVE-2022-35864, it is recommended to apply the patches provided by BMC to the affected versions of BMC Track-It!.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-967
- alias/ZDI-CAN-16690
- alias/CVE-2022-35864
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/bmc
- canonical/bmc track-it\!
- version/bmc track-it\!/20.19.03
- version/bmc track-it\!/20.20.01
- version/bmc track-it\!/20.20.02
- version/bmc track-it\!/20.20.03
- version/bmc track-it\!/20.21.01
- version/bmc track-it\!/20.21.02
- canonical/bmc track-it!