CVE-2022-35864CWE-89

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!

Medium · published August 3, 2022

CVSS v3.0
5.3
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01648 · 76.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-08-03T15:21Z
EPSS history
Timeline
  • 03 AUG 15:21Z
    This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!
    cvelistv5