Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rt4 | Oct 1, 2024 | Jul 14, 2022 |
| Debian | — | Upgrade request-tracker4Upgrade request-tracker5 | Aug 17, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade rt4-db-postgresql (Ubuntu Pro)Upgrade rt4-fcgiUpgrade rt4-db-postgresqlUpgrade rt5-fcgi (Ubuntu Pro)Upgrade rt4-db-mysql (Ubuntu Pro)Upgrade rt4-clients (Ubuntu Pro)Upgrade rt4-db-mysqlUpgrade rt4-clientsUpgrade rt4-apache2Upgrade rt4-fcgi (Ubuntu Pro)Upgrade rt5-standalone (Ubuntu Pro)Upgrade request-tracker4Upgrade request-tracker4 (Ubuntu Pro)Upgrade rt4-apache2 (Ubuntu Pro)Upgrade rt4-db-sqliteUpgrade rt4-standaloneUpgrade rt4-db-sqlite (Ubuntu Pro)Upgrade request-tracker5 (Ubuntu Pro)Upgrade rt4-standalone (Ubuntu Pro) | Dec 5, 2023 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub