CVE-2016-6127 Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows...
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.4.1-4 | 4.4.1-4 |
| bestpractical request tracker | = 4.0.0 | No fix listed |
| bestpractical request tracker | = 4.0.1 | No fix listed |
| bestpractical request tracker | = 4.0.2 | No fix listed |
| bestpractical request tracker | = 4.0.3 | No fix listed |
| bestpractical request tracker | = 4.0.4 | No fix listed |
| bestpractical request tracker | = 4.0.5 | No fix listed |
| bestpractical request tracker | = 4.0.6 | No fix listed |
| bestpractical request tracker | = 4.0.7 | No fix listed |
| bestpractical request tracker | = 4.0.8 | No fix listed |
| bestpractical request tracker | = 4.0.9 | No fix listed |
| bestpractical request tracker | = 4.0.10 | No fix listed |
| bestpractical request tracker | = 4.0.11 | No fix listed |
| bestpractical request tracker | = 4.0.12 | No fix listed |
| bestpractical request tracker | = 4.0.13 | No fix listed |
| bestpractical request tracker | = 4.0.14 | No fix listed |
| bestpractical request tracker | = 4.0.15 | No fix listed |
| bestpractical request tracker | = 4.0.16 | No fix listed |
| bestpractical request tracker | = 4.0.17 | No fix listed |
| bestpractical request tracker | = 4.0.18 | No fix listed |
| bestpractical request tracker | = 4.0.19 | No fix listed |
| bestpractical request tracker | = 4.0.20 | No fix listed |
| bestpractical request tracker | = 4.0.21 | No fix listed |
| bestpractical request tracker | = 4.0.22 | No fix listed |
| bestpractical request tracker | = 4.0.23 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical request tracker | = 4.0.24 | No fix listed |
| bestpractical request tracker | = 4.2.0 | No fix listed |
| bestpractical request tracker | = 4.2.1 | No fix listed |
| bestpractical request tracker | = 4.2.2 | No fix listed |
| bestpractical request tracker | = 4.2.3 | No fix listed |
| bestpractical request tracker | = 4.2.4 | No fix listed |
| bestpractical request tracker | = 4.2.5 | No fix listed |
| bestpractical request tracker | = 4.2.6 | No fix listed |
| bestpractical request tracker | = 4.2.7 | No fix listed |
| bestpractical request tracker | = 4.2.8 | No fix listed |
| bestpractical request tracker | = 4.2.9 | No fix listed |
| bestpractical request tracker | = 4.2.10 | No fix listed |
| bestpractical request tracker | = 4.2.11 | No fix listed |
| bestpractical request tracker | = 4.2.12 | No fix listed |
| bestpractical request tracker | = 4.2.13 | No fix listed |
| bestpractical request tracker | = 4.4.0 | No fix listed |
| bestpractical request tracker | = 4.4.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-6127 vendor-advisory
- DSA-3882 third-party-advisory vendor-advisory
- 99375 third-party-advisory vdb-entry
- forum.bestpractical.com vendor-advisory