CVE-2018-20735

Patrol Agent vulnerability

CVSS

7.8

EPSS

7.5%

EPSS pct

94th

Exploited

No known

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration

Affected vendor

Bmc

Affected product

Patrol Agent

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)

CWE-287 — Improper Authentication

Published

2019-01-17

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable with local access, low attack complexity, requiring low privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 7.5% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 94% of all scored CVEs.

Check your external exposure to CVE-2018-20735

Confirm whether Bmc Patrol Agent is running on any internet-facing host or subdomain.
Match discovered service fingerprints against the version affected by CVE-2018-20735.
Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2018-20735

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2018-20735 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2018-20735?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2018-20735.

Start free scan

No credit card. Agentless.

Related vulnerabilities

Data Engine vulnerability

HIGH

CVE-2008-0107

Data Engine vulnerability