CVE-2017-17674

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-17674
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://bmc.com Product
http://remedy.com Product
https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html Release Notes Vendor Advisory
https://seclists.org/fulldisclosure/2017/Oct/52 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bmc:remedy_mid-tier:9.1:sp3:*:*:*:*:*:*
History

25 May 2021, 18:04

Type Values Removed Values Added
CWE CWE-918
CVSS v2 : unknown
v3 : unknown 		v2 : 7.5
v3 : 9.8
References (MISC) https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - (MISC) https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - Release Notes, Vendor Advisory
References (MISC) https://seclists.org/fulldisclosure/2017/Oct/52 - (MISC) https://seclists.org/fulldisclosure/2017/Oct/52 - Mailing List, Third Party Advisory
References (MISC) http://remedy.com - (MISC) http://remedy.com - Product
References (MISC) http://bmc.com - (MISC) http://bmc.com - Product
CPE cpe:2.3:a:bmc:remedy_mid-tier:9.1:sp3:*:*:*:*:*:*

19 May 2021, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-05-19 14:15

Updated : 2023-12-10 13:55

NVD link : CVE-2017-17674

Mitre link : CVE-2017-17674

CVE.ORG link : CVE-2017-17674

JSON object : View

Products Affected

bmc

  • remedy_mid-tier
CWE
CWE-918

Server-Side Request Forgery (SSRF)