PT-2017-16776 · Best Practical Solutions · Request Tracker

Published 2017-06-15 · Updated 2017-09-03 · CVE-2017-5943

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Request Tracker (RT) versions 4.0.0 through 4.0.24 Request Tracker (RT) versions 4.2.0 through 4.2.13 Request Tracker (RT) versions 4.4.0 through 4.4.1

Description The issue allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL. This can potentially be used to bypass security measures.

Recommendations For versions 4.0.0 through 4.0.24, update to version 4.0.25 or later. For versions 4.2.0 through 4.2.13, update to version 4.2.14 or later. For versions 4.4.0 through 4.4.1, update to version 4.4.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-5943

DLA-987-1

DSA-3882-1

MGASA-2017-0325

Affected Products

Request Tracker

References · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5943 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0325 · Vendor Advisory
• https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 · Vendor Advisory
• http://debian.org/security/2017/dsa-3882 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5943 · Security Note
• https://ubuntu.com/security/CVE-2017-5943 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5943 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5943 · Security Note
• https://osv.dev/vulnerability/DSA-3882-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0325.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5943 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-5943 · Vendor Advisory
• http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html · Note
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=16665 · Note