| Package | Affected versions | Patched versions |
|---|---|---|
| remedy action request system server | = 7.1 |
Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a UserData_Init call.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free