7.5
CVE-2016-2349
- EPSS 1.06%
- Veröffentlicht 21.12.2016 22:59:00
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginRemedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bmc ≫ Remedy Action Request System Version 8.1 Update sp2
Bmc ≫ Remedy Action Request System Version 9.0
Bmc ≫ Remedy Action Request System Version 9.0 Update sp1
Bmc ≫ Remedy Action Request System Version 9.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.06% | 0.6 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-640 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
http://www.securityfocus.com/bid/95075
http://www.securitytracker.com/id/1037529
https://bmcsites.force.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000l6kbCAA&type=Solution