A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.
bd alaris systems manager