CVE-2016-2349

HIGH

BMC Remedy AR System Server 8.1 SP 2, 9.0, 9.0 SP 1, 9.1 - Weak Password Recovery Mechanism via Blank Previous Password

Title source: llm

Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

Mitigation, Vendor Advisory x_refsource_confirm

CVSS v3 7.5

EPSS 0.0106

EPSS Percentile 59.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-640

Status published

Products (3)

bmc/remedy_action_request_system 8.1 sp2

bmc/remedy_action_request_system 9.0 (2 CPE variants)

bmc/remedy_action_request_system 9.1

Published Dec 21, 2016

Tracked Since Feb 18, 2026