vulnwire
5.3med

CVE-2017-17675

BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking.

Published 5 y ago · modified 3 mo ago · JSON

CVSS
5.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known

BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.

Exploit prediction (EPSS)

0.87% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

  • docs.bmc.com /docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555 · x_refsource_MISC, x_transferred
  • seclists.org /fulldisclosure/2017/Oct/52 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.