ZDI-CAN-14122: BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-14122?
The severity of ZDI-CAN-14122 is critical due to its potential for remote code execution.
How do I fix ZDI-CAN-14122?
To fix ZDI-CAN-14122, it is recommended to update to the latest patched version of BMC Track-It!.
Who is affected by ZDI-CAN-14122?
BMC Track-It! installations that process email attachments are affected by ZDI-CAN-14122.
Does ZDI-CAN-14122 require authentication to exploit?
Yes, ZDI-CAN-14122 requires authentication for an attacker to exploit the vulnerability.
What type of vulnerability is ZDI-CAN-14122?
ZDI-CAN-14122 is a remote code execution vulnerability related to the processing of email attachments.