CVE-2017-17674

BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).

• CWE-918

• https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.htmlRelease Notes, Vendor Advisory
• https://seclists.org/fulldisclosure/2017/Oct/52Mailing List, Third Party Advisory
• https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.htmlRelease Notes, Vendor Advisory
• https://seclists.org/fulldisclosure/2017/Oct/52Mailing List, Third Party Advisory

Published

May 19, 2021

Last Modified

Jul 9, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17668Memory write mechanism in NCR S1 Dispenser controller before…
• CVE-2017-17669There is a heap-based buffer over-read in the Exiv2::Interna…5.5
• CVE-2017-1767IBM Business Process Manager 8.6 is vulnerable to cross-site…5.4
• CVE-2017-17670In VideoLAN VLC media player through 2.2.8, there is a type …
• CVE-2017-17671vBulletin through 5.3.x on Windows allows remote PHP code ex…9.8
• CVE-2017-17672In vBulletin through 5.3.x, there is an unauthenticated dese…
• CVE-2017-17675BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Rem…5.3
• CVE-2017-17677BMC Remedy 9.1SP3 is affected by authenticated code executio…8.8
• CVE-2017-17678BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripti…6.1
• CVE-2017-1768IBM Security Guardium Big Data Intelligence (SonarG) 3.1 gen…4.3
• CVE-2017-17680In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was…
• CVE-2017-17681In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability …