VulnerabilityModified
CVE-2015-5072
The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary local files via the __imageid parameter.
MEDIUM 6.5EPSS 1.68%
Does this matter?
Lower severity and a low EPSS score (1.68%). Track it; it rarely justifies an emergency change on its own.
Description
The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary local files via the __imageid parameter.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.68% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- bmc/remedy ar system server
- Source
- cve@mitre.org
References
- https://communities.bmc.com/docs/DOC-77816Vendor Advisory
- https://packetstormsecurity.com/files/133689/BMC-Remedy-AR-8.1-9.0-File-Inclusion.htmlThird Party Advisory, VDB Entry
- https://communities.bmc.com/docs/DOC-77816Vendor Advisory
- https://packetstormsecurity.com/files/133689/BMC-Remedy-AR-8.1-9.0-File-Inclusion.htmlThird Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.