CVE-2017-5944 The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute ar...
HighCVSS 8.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.4.1-4 | 4.4.1-4 |
| bestpractical request tracker | = 4.0.0 | No fix listed |
| bestpractical request tracker | = 4.0.1 | No fix listed |
| bestpractical request tracker | = 4.0.2 | No fix listed |
| bestpractical request tracker | = 4.0.3 | No fix listed |
| bestpractical request tracker | = 4.0.4 | No fix listed |
| bestpractical request tracker | = 4.0.5 | No fix listed |
| bestpractical request tracker | = 4.0.6 | No fix listed |
| bestpractical request tracker | = 4.0.7 | No fix listed |
| bestpractical request tracker | = 4.0.8 | No fix listed |
| bestpractical request tracker | = 4.0.9 | No fix listed |
| bestpractical request tracker | = 4.0.10 | No fix listed |
| bestpractical request tracker | = 4.0.11 | No fix listed |
| bestpractical request tracker | = 4.0.12 | No fix listed |
| bestpractical request tracker | = 4.0.13 | No fix listed |
| bestpractical request tracker | = 4.0.14 | No fix listed |
| bestpractical request tracker | = 4.0.15 | No fix listed |
| bestpractical request tracker | = 4.0.16 | No fix listed |
| bestpractical request tracker | = 4.0.17 | No fix listed |
| bestpractical request tracker | = 4.0.18 | No fix listed |
| bestpractical request tracker | = 4.0.19 | No fix listed |
| bestpractical request tracker | = 4.0.20 | No fix listed |
| bestpractical request tracker | = 4.0.21 | No fix listed |
| bestpractical request tracker | = 4.0.22 | No fix listed |
| bestpractical request tracker | = 4.0.23 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical request tracker | = 4.0.24 | No fix listed |
| bestpractical request tracker | = 4.2.0 | No fix listed |
| bestpractical request tracker | = 4.2.1 | No fix listed |
| bestpractical request tracker | = 4.2.2 | No fix listed |
| bestpractical request tracker | = 4.2.3 | No fix listed |
| bestpractical request tracker | = 4.2.4 | No fix listed |
| bestpractical request tracker | = 4.2.5 | No fix listed |
| bestpractical request tracker | = 4.2.6 | No fix listed |
| bestpractical request tracker | = 4.2.7 | No fix listed |
| bestpractical request tracker | = 4.2.8 | No fix listed |
| bestpractical request tracker | = 4.2.9 | No fix listed |
| bestpractical request tracker | = 4.2.10 | No fix listed |
| bestpractical request tracker | = 4.2.11 | No fix listed |
| bestpractical request tracker | = 4.2.12 | No fix listed |
| bestpractical request tracker | = 4.2.13 | No fix listed |
| bestpractical request tracker | = 4.4.0 | No fix listed |
| bestpractical request tracker | = 4.4.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-5944 vendor-advisory
- DSA-3882 third-party-advisory vendor-advisory
- 99381 third-party-advisory vdb-entry
- forum.bestpractical.com vendor-advisory