PT-2017-16777 · Best Practical Solutions · Request Tracker

Publicado 2017-06-15 · Atualizado 2019-10-03 · CVE-2017-5944

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Request Tracker versions 4.0.0 through 4.0.24 Request Tracker versions 4.2.0 through 4.2.13 Request Tracker versions 4.4.0 through 4.4.1

Description The issue concerns the dashboard subscription interface in Request Tracker, which might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Recommendations For versions 4.0.0 through 4.0.24, update to version 4.0.25 or later. For versions 4.2.0 through 4.2.13, update to version 4.2.14 or later. For versions 4.4.0 through 4.4.1, update to version 4.4.2 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-5944

DLA-987-1

DSA-3882-1

MGASA-2017-0325

Produtos afetados

Request Tracker

Referências · 18

• http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html · Nota
• https://osv.dev/vulnerability/MGASA-2017-0325 · Aviso do Fabricante
• https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-5944 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5944 · Aviso do Fabricante
• http://debian.org/security/2017/dsa-3882 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5944 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3882-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0325.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5944 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5944 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-5944 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=16665 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2015-February/000273.html · Nota