CVE-2015-5475: XSS
First published: Fri Aug 14 2015(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Request Tracker | <=4.2.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html
- http://www.debian.org/security/2015/dsa-3335
- http://www.securityfocus.com/bid/76364
- https://bestpractical.com/release-notes/rt/4.2.12
Frequently Asked Questions
What is the severity of CVE-2015-5475?
CVE-2015-5475 has a severity rating of high due to the potential for remote code execution via XSS attacks.
How do I fix CVE-2015-5475?
To fix CVE-2015-5475, upgrade Request Tracker to version 4.2.12 or later.
What are the potential impacts of CVE-2015-5475?
CVE-2015-5475 allows remote attackers to execute arbitrary scripts in the context of user sessions.
Which versions of Request Tracker are affected by CVE-2015-5475?
Request Tracker versions 4.2.11 and earlier are affected by CVE-2015-5475.
How can I detect if my system is vulnerable to CVE-2015-5475?
You can detect vulnerability to CVE-2015-5475 by checking the version of Request Tracker you have installed.
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/bestpractical
- canonical/request tracker
- version/request tracker/4.2.11