bestpractical request tracker 4.2.2 vulnerabilities and exploits

(subscribe to this query)

RT (aka Request Tracker) prior to 4.0.23 and 4.2.x prior to 4.2.10 allows remote malicious users to hijack sessions via an RSS feed URL.

Fedoraproject Fedora 22 Fedoraproject Fedora 21 Bestpractical Request Tracker 4.2.9 Bestpractical Request Tracker 4.2.1 Bestpractical Request Tracker 4.2.2 Bestpractical Request Tracker 4.2.3 Bestpractical Request Tracker 4.2.4 Bestpractical Request Tracker Bestpractical Request Tracker 4.2.6 Bestpractical Request Tracker 4.2.8 Bestpractical Request Tracker 4.2.0 Bestpractical Request Tracker 4.2.5 Bestpractical Request Tracker 4.2.7

Request Tracker (RT) 4.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote malicious users to obtain sensitive user password information via a timing side-channel attack...

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote malicious users to inject arbitrary web script or HTML via a file ...

Request Tracker (RT) 4.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2 allows remote malicious users to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.

The dashboard subscription interface in Request Tracker (RT) 4.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

RT (aka Request Tracker) 3.8.8 up to and including 4.x prior to 4.0.23 and 4.2.x prior to 4.2.10 allows remote malicious users to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.

The email gateway in RT (aka Request Tracker) 3.0.0 up to and including 4.x prior to 4.0.23 and 4.2.x prior to 4.2.10 allows remote malicious users to cause a denial of service (CPU and disk consumption) via a crafted email.

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook