ZDI-22-002: BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-002?
The severity of ZDI-22-002 is critical due to its potential to allow remote code execution.
How do I fix ZDI-22-002?
To fix ZDI-22-002, users should ensure that their BMC Track-It! installations are updated to the latest patched version.
Who is affected by ZDI-22-002?
ZDI-22-002 affects installations of BMC Track-It! that process email attachments without proper validation.
What type of vulnerability is ZDI-22-002?
ZDI-22-002 is a remote code execution vulnerability that requires authentication to exploit.
Can ZDI-22-002 be exploited without authentication?
No, ZDI-22-002 requires authentication to exploit, limiting the threat to authenticated users.