PT-2015-6933 · Best Practical · Request Tracker

Marcin Kopeć · Publicado 2015-08-13 · Atualizado 2017-09-03 · CVE-2015-5475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Request Tracker (RT) versions 4.x through 4.2.11 Request Tracker (RT) versions prior to 4.2.12

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vectors related to the user and group rights management pages, specifically through the group rights management pages.

Recommendations For versions 4.x through 4.2.11, update to version 4.2.12 or later. For versions prior to 4.2.12, update to version 4.2.12 or later. As a temporary workaround, consider restricting access to the group rights management pages and limiting user input to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-5475

DSA-3335-1

MGASA-2017-0325

Produtos afetados

Request Tracker

Referências · 30

• https://github.com/bestpractical/rt/commit/67d517ba3421ba462e349c73207a627d137ef8ac · Nota
• https://github.com/bestpractical/rt/commit/4ec786bb4743f67a35a634c1bf43b13d3d3b39a9 · Nota
• https://osv.dev/vulnerability/DSA-3335-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=16665 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5475 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html · Aviso do Fabricante
• https://packages.debian.org/src:request-tracker4 · Nota
• https://security-tracker.debian.org/tracker/source-package/request-tracker4 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3335-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5475 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-5475 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5475 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2015-August/000279.html · Nota
• https://bestpractical.com/release-notes/rt/4.2.12 · Aviso do Fabricante