CVE-2012-6581: Medium severity request tracker vulnerability
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6581?
CVE-2012-6581 has a medium severity rating due to its potential to allow unauthorized access to sensitive keyring data.
How do I fix CVE-2012-6581?
To fix CVE-2012-6581, upgrade to Best Practical Solutions Request Tracker version 3.8.15 or 4.0.8 or later.
What versions are affected by CVE-2012-6581?
CVE-2012-6581 affects Best Practical Solutions Request Tracker versions 3.8.x before 3.8.15 and 4.0.x before 4.0.8.
What is the impact of CVE-2012-6581?
CVE-2012-6581 allows attackers to bypass restrictions on reading keys and send emails signed with arbitrary secret keys.
Is GnuPG necessary for CVE-2012-6581 to be exploited?
Yes, GnuPG must be enabled for CVE-2012-6581 to be exploited.