vulnerability

Ubuntu: (CVE-2016-6127): request-tracker4 vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Jul 3, 2017

Added

Nov 19, 2024

Modified

Mar 27, 2026

Description

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.

Solution

ubuntu-upgrade-request-tracker4

References

CVE-2016-6127
https://attackerkb.com/topics/CVE-2016-6127
CWE-79
DEBIAN-DSA-3882
EUVD-EUVD-2016-7061
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-7061
https://www.cve.org/CVERecord?id=CVE-2016-6127

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report