CVE-2022-24047
Assigner: zdi
Published: 2022-02-18T19:51:40
State: PUBLISHED
affected: product: Track-It!
vendor: BMC
versions: status: affected
version: 20.21.01.102
credits: value: Markus Wulftange (@mwulftange)
descriptions: value: This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618.
metrics: cvssV3_0: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.0
problemTypes: descriptions: cweId: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
type: CWE