Vulnerability in Bmc Remedy_action_request_system
CVE-2016-2349
Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.
EPSS: 0.011 (60.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Bmc Remedy_action_request_system — versions 8.1, 9.0, 9.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (vdb-entry, x_refsource_SECTRACK)
- cret@cert.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2016-2349?
- CVE-2016-2349 is a high-severity vulnerability in Bmc Remedy_action_request_system, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 7.5/10. Published 2016-12-21.
- How severe is CVE-2016-2349?
- High severity. CVSS v3 base score is 7.5 out of 10.