Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rt4 | Oct 1, 2024 | Nov 3, 2023 |
| Debian | — | Upgrade request-tracker4Upgrade request-tracker5 | Nov 1, 2023 | Nov 1, 2023 |
| Freebsd | — | Upgrade rt44Upgrade rt50 | Dec 10, 2025 | Oct 18, 2023 |
| Ubuntu | — | Upgrade rt4-standalone (Ubuntu Pro)Upgrade rt4-db-sqlite (Ubuntu Pro)Upgrade rt4-apache2Upgrade request-tracker4 (Ubuntu Pro)Upgrade rt4-db-sqliteUpgrade rt5-fcgiUpgrade rt4-db-postgresql (Ubuntu Pro)Upgrade rt4-db-postgresqlUpgrade rt5-fcgi (Ubuntu Pro)Upgrade request-tracker4Upgrade rt5-standaloneUpgrade rt5-standalone (Ubuntu Pro)Upgrade rt4-fcgiUpgrade request-tracker5Upgrade rt4-fcgi (Ubuntu Pro)Upgrade rt4-apache2 (Ubuntu Pro)Upgrade rt4-db-mysqlUpgrade rt4-db-mysql (Ubuntu Pro)Upgrade rt4-clients (Ubuntu Pro)Upgrade rt4-clientsUpgrade request-tracker5 (Ubuntu Pro)Upgrade rt4-standalone | Dec 5, 2023 | Nov 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub