CVE Vulnerabilities

CVE-2015-5071

Improper Privilege Management

Published: Jan 15, 2020 | Modified: Jan 24, 2020
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to navigate to arbitrary files via the __report parameter of the BIRT viewer servlet.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Remedy_ar_system_server Bmc 9.0 9.0
Remedy_ar_system_server Bmc 8.0 8.0

Potential Mitigations

References