CVE-2015-5071

MEDIUM

BMC Remedy AR System Server - Authenticated Arbitrary File Read via BIRT Viewer __report Parameter

Title source: llm

Description

AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry x_refsource_misc

https://packetstormsecurity.com/files/133688/BMC-Remedy-AR-8.1-9.0-File-Inclusion.html

Third Party Advisory x_refsource_confirm

https://communities.bmc.com/docs/DOC-77816

Scores

CVSS v3 6.5

EPSS 0.0178

EPSS Percentile 75.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-269

Status published

Products (2)

bmc/remedy_ar_system_server 8.0

bmc/remedy_ar_system_server 9.0

Published Jan 15, 2020

Tracked Since Feb 18, 2026