ZDI-CAN-14527: BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-14527?
The severity of ZDI-CAN-14527 is considered to be medium due to the sensitive information disclosure risk.
How do I fix ZDI-CAN-14527?
To fix ZDI-CAN-14527, ensure that your installation of BMC Track-It! is updated to the latest patched version provided by BMC.
What types of sensitive information are exposed by ZDI-CAN-14527?
ZDI-CAN-14527 may expose sensitive configuration or operational data that could aid in further exploitation.
Is authentication required to exploit ZDI-CAN-14527?
Yes, authentication is required to exploit ZDI-CAN-14527, which means attackers need valid credentials.
Which software is affected by ZDI-CAN-14527?
ZDI-CAN-14527 affects BMC Track-It! installations that have not been patched.