CVE-2017-5943

High

Published: 03/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Request Tracker (RT) versions 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allow remote attackers to obtain sensitive information about CSRF verification tokens via a crafted URL.

Risk Assessment

Attackers can exploit this vulnerability to steal verification tokens, potentially leading to unauthorized access to user data.

Recommendation

It is recommended to upgrade to the latest version of Request Tracker to mitigate this vulnerability.

Other vulnerabilities in Request Tracker (RT)

CVE-2017-5944High
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Original NVD description (English source)

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.