CVE-2021-35001CWE-862

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability

Low · published May 7, 2024

CVSS v3.0
3.1
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability.

The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-14527.

The record
Technical detail
CVSS v3.0
3.1 · LOW
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00757 · 54.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-05-07T22:54Z
EPSS history
Timeline
  • 07 MAY 22:54Z
    BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability
    cvelistv5