CWE Code: 287
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Improper Authentication
Summary: ** disputed ** an issue was discovered in bmc patrol agent through 11.3.01. it was found that the patrolcli application can allow for lateral movement and escalation of privilege inside a windows active directory environment. it was found that by default the patrolcli / patrol agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. this means if you have patrol agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with patrolcli and then connect to the domain controller and run commands as system. this means any user on a domain can escalate to domain admin through patrol agent. note: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-01-17
Last Modified Date: 2019-10-03