PT-2015-6933 · Best Practical · Request Tracker

Marcin Kopeć · Published 2015-08-13 · Updated 2017-09-03 · CVE-2015-5475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Request Tracker (RT) versions 4.x through 4.2.11 Request Tracker (RT) versions prior to 4.2.12

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vectors related to the user and group rights management pages, specifically through the group rights management pages.

Recommendations For versions 4.x through 4.2.11, update to version 4.2.12 or later. For versions prior to 4.2.12, update to version 4.2.12 or later. As a temporary workaround, consider restricting access to the group rights management pages and limiting user input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-5475

DSA-3335-1

MGASA-2017-0325

Affected Products

Request Tracker

References · 30

• https://osv.dev/vulnerability/DSA-3335-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5475 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/request-tracker4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3335-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5475 · Security Note
• https://ubuntu.com/security/CVE-2015-5475 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5475 · Vendor Advisory
• https://bestpractical.com/release-notes/rt/4.2.12 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5475 · Security Note
• https://osv.dev/vulnerability/CVE-2015-5475 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5475 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6506 · Security Note
• https://advisories.mageia.org/MGASA-2017-0325.html · Security Note
• http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html · Vendor Advisory