BMC Remedy AR System prior to 9.1 SP3, when Remedy AR Authentication is enabled, allows malicious users to obtain administrative access.
bmc remedy action request system