CVE-2018-19505

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a UserData_Init call.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/150492/BMC-Remedy-7.1-User-Impersonation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Nov/62Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042177Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/150492/BMC-Remedy-7.1-User-Impersonation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Nov/62Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042177Third Party Advisory, VDB Entry

Timeline

Published: Jan 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195064.8Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.CVE-2018-195074.8CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.CVE-2018-195084.8CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.CVE-2018-195096.1wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encodin CVE-2018-19515.4IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2018-195109.8subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.CVE-2018-195116.5wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator p CVE-2018-195127.2In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by au CVE-2018-195137.5In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filen CVE-2018-195149.8In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation require CVE-2018-195159.8In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the CVE-2018-195165.3messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an