Cross-site Scripting (XSS) Affecting request-tracker4 package, versions <4.2.11-2


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.28% (69th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN12-REQUESTTRACKER4-1559090
  • published 14 Aug 2015
  • disclosed 14 Aug 2015

How to fix?

Upgrade Debian:12 request-tracker4 to version 4.2.11-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream request-tracker4 package and not the request-tracker4 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.

CVSS Scores

version 3.1
Expand this section

NVD

4.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    Low
  • Availability (A)
    None