SecuriTricks - CVE-2024-34398

Description

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers.

Product(s) Impacted

Vendor	Product	Versions
Bmc Remedy	Mid Tier	7.6.04

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	bmc_remedy	mid_tier	7.6.04	/	/	/	/	/	/	/

References

https://www.gruppotim.it/it/footer/red-team.html

CVSS Score

4.2 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE

View Vector String

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Date

Published: March 12, 2025, 5:15 p.m.
Last Modified: March 12, 2025, 7:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-34398