Request Tracker Security Bypass and Information Disclosure Vulnerability
BID:46493
Info
Request Tracker Security Bypass and Information Disclosure Vulnerability
| Bugtraq ID: | 46493 |
| Class: | Design Error |
| CVE: |
CVE-2011-1007 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 16 2011 12:00AM |
| Updated: | Feb 16 2011 12:00AM |
| Credit: | Best Practical Solutions |
| Vulnerable: |
Bestpractical RT 3.8.8 Bestpractical RT 3.8.6 Bestpractical RT 3.8.5 Bestpractical RT 3.8.4 Bestpractical RT 3.8.2 Bestpractical RT 3.6.7 Bestpractical RT 3.6.6 Bestpractical RT 3.6.2 |
| Not Vulnerable: |
Bestpractical RT 3.8.9 |
Discussion
Request Tracker Security Bypass and Information Disclosure Vulnerability
Request Tracker is prone to an information-disclosure vulnerability and a security-bypass vulnerability.
Successful attacks can allow a attacker to obtain sensitive information and bypass certain security restrictions.
Versions prior to 3.8.9 are affected.
Request Tracker is prone to an information-disclosure vulnerability and a security-bypass vulnerability.
Successful attacks can allow a attacker to obtain sensitive information and bypass certain security restrictions.
Versions prior to 3.8.9 are affected.
Exploit / POC
Request Tracker Security Bypass and Information Disclosure Vulnerability
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Request Tracker Security Bypass and Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Request Tracker Security Bypass and Information Disclosure Vulnerability
References:
References:
- [Rt-announce] RT 3.8.9 Released (Best Practical Solutions )
- CVE Request -- rt3 -- two issues (Jan Lieskovsky )
- RT Homepage (Best Practical Solutions)