CVE-2022-35865 - CVE House

Back to Database

Status published High CVE-2022-35865

This vulnerability allows remote attackers to execute arbitrary code on...

7.3 CVSS

Vulnerability Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35865

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Markus Wulftange (@mwulftange)

References

More from BMC

View All →

BMC Control-M/Agent memory corruption in SSL/TLS communication

BMC Control-M/Agent buffer overflow in SSL/TLS communication

BMC Control-M/Agent buffer overflow local privilege escalation

BMC Control-M/Agent path traversal local privilege escalation

BMC Control-M/Agent improper IP address filtering order

Affected Vendor

BMC

View all reports →

Affected Software

Track-It!

Vulnerable Versions:

20.21.2.109

Timeline

Official Publish: August 3rd, 2022

Last Modified: June 2nd, 2026

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement