SB2022010710 - Multiple vulnerabilities in BMC Track-It!

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2021-35001)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the lack of authorization within the GetData endpoint. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

2) Arbitrary file upload (CVE-ID: CVE-2021-35002)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the processing of email attachments. A remote authenticated attacker can upload a malicious file and execute it on the server.

Remediation

Install update from vendor's website.

References

• https://www.zerodayinitiative.com/advisories/ZDI-22-001/
• https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
• https://www.zerodayinitiative.com/advisories/ZDI-22-002/