Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rt4 | Oct 1, 2024 | Oct 18, 2021 |
| Debian | — | Upgrade request-tracker4Upgrade request-tracker5 | Jun 24, 2022 | Oct 18, 2021 |
| Ubuntu | — | Upgrade request-tracker5 (Ubuntu Pro)Upgrade rt4-apache2Upgrade rt4-clientsUpgrade rt4-db-sqlite (Ubuntu Pro)Upgrade rt4-db-postgresql (Ubuntu Pro)Upgrade request-tracker4 (Ubuntu Pro)Upgrade rt4-db-mysql (Ubuntu Pro)Upgrade request-tracker4Upgrade rt4-apache2 (Ubuntu Pro)Upgrade rt4-db-mysqlUpgrade rt4-standaloneUpgrade rt4-db-postgresqlUpgrade rt4-clients (Ubuntu Pro)Upgrade rt4-standalone (Ubuntu Pro)Upgrade rt4-fcgi (Ubuntu Pro)Upgrade rt4-fcgiUpgrade rt5-standalone (Ubuntu Pro)Upgrade rt4-db-sqliteUpgrade rt5-fcgi (Ubuntu Pro) | Dec 5, 2023 | Oct 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub