6.4

CVE-2015-1464

RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version 21
Fedoraproject ≫ Fedora Version 22
Bestpractical ≫ Request Tracker Version <= 4.0.22
Bestpractical ≫ Request Tracker Version 4.2.0
Bestpractical ≫ Request Tracker Version 4.2.1
Bestpractical ≫ Request Tracker Version 4.2.2
Bestpractical ≫ Request Tracker Version 4.2.3
Bestpractical ≫ Request Tracker Version 4.2.4
Bestpractical ≫ Request Tracker Version 4.2.5
Bestpractical ≫ Request Tracker Version 4.2.6
Bestpractical ≫ Request Tracker Version 4.2.7
Bestpractical ≫ Request Tracker Version 4.2.8
Bestpractical ≫ Request Tracker Version 4.2.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.99% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
http://www.debian.org/security/2015/dsa-3176