CVE-2014-4872 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configura...
HighCVSS 7.5
EPSS 79.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc track-it | = 11.3.0.355 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- VU#121036 third-party-advisory us-government-resource
- raw.githubusercontent.com broken-link third-party-advisory