SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2021-35002

Unrestricted File Upload Remote Code Execution Vulnerability.

HIGH 8.8EPSS 1.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14122.

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.65% probability · 75th percentile
CISA KEV
Not listed
Weakness
CWE-434
Affected
bmc/track-it\!
Source
zdi-disclosures@trendmicro.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.