BMC Track-It! Web Account Credential Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of password resets. The issue lies in the ability to register an account matching the name of a local account on the system and then reset the password for it. An attacker can leverage this vulnerability to gain credentials for the Administrator account on the system.