CVE-2012-6578: Medium severity request tracker vulnerability
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which might allow remote attackers to spoof messages by leveraging the lack of authentication semantics.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6578?
The severity of CVE-2012-6578 is considered to be moderate as it allows for message spoofing due to inadequate authentication.
How do I fix CVE-2012-6578?
To fix CVE-2012-6578, upgrade to Best Practical Solutions Request Tracker version 3.8.15 or later, or 4.0.8 or later.
What versions of Request Tracker are affected by CVE-2012-6578?
CVE-2012-6578 affects Best Practical Solutions Request Tracker versions 3.8.x prior to 3.8.15 and 4.0.x prior to 4.0.8.
Can CVE-2012-6578 be exploited remotely?
Yes, CVE-2012-6578 can be exploited remotely by attackers to spoof messages.
What is the main risk associated with CVE-2012-6578?
The main risk associated with CVE-2012-6578 is unauthorized message authentication, leading to potential misinformation or action taken based on spoofed messages.