CVE-2021-35002

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

EPSS

1.65%

Published

May 7, 2024

Modified

Apr 10, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14122.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434CWE-434

Affected Products (7)

bmc · track-it\!vulnerable

References (4)

https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-002/

Third Party Advisory

https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-002/

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs