CVE-2021-35002

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability.

The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14122.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
BMC	Track-It!	20.21.01.102
bmc	track-it\!	>= 20.19.01, <= 20.21.01

References

https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-ItVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-002/Third Party Advisory
https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-ItVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-002/Third Party Advisory

Timeline

Published: May 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-350039.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 re CVE-2021-350049.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel CVE-2021-350053.3This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer. An attacker must first CVE-2021-35017.1A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, whic CVE-2021-35025.5A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to CVE-2021-350277.5A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access CVE-2021-350287.8A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to ex CVE-2021-350299.8An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 CVE-2021-35034.3A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability CVE-2021-350304.3A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and c CVE-2021-350318.0A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow CVE-2021-350327.8A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbit