CVE-2016-6127: XSS

Published Jul 3, 2017

Updated

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.

Affected Software

41 affected components

bestpractical Request Tracker=4.0.0

bestpractical Request Tracker=4.0.1

bestpractical Request Tracker=4.0.2

bestpractical Request Tracker=4.0.3

bestpractical Request Tracker=4.0.4

bestpractical Request Tracker=4.0.5

bestpractical Request Tracker=4.0.6

bestpractical Request Tracker=4.0.7

bestpractical Request Tracker=4.0.8

bestpractical Request Tracker=4.0.9

bestpractical Request Tracker=4.0.10

bestpractical Request Tracker=4.0.11

bestpractical Request Tracker=4.0.12

bestpractical Request Tracker=4.0.13

bestpractical Request Tracker=4.0.14

bestpractical Request Tracker=4.0.15

bestpractical Request Tracker=4.0.16

bestpractical Request Tracker=4.0.17

bestpractical Request Tracker=4.0.18

bestpractical Request Tracker=4.0.19

bestpractical Request Tracker=4.0.20

bestpractical Request Tracker=4.0.21

bestpractical Request Tracker=4.0.22

bestpractical Request Tracker=4.0.23

bestpractical Request Tracker=4.0.24

bestpractical Request Tracker=4.2.0

bestpractical Request Tracker=4.2.1

bestpractical Request Tracker=4.2.2

bestpractical Request Tracker=4.2.3

bestpractical Request Tracker=4.2.4

bestpractical Request Tracker=4.2.5

bestpractical Request Tracker=4.2.6

bestpractical Request Tracker=4.2.7

bestpractical Request Tracker=4.2.8

bestpractical Request Tracker=4.2.9

bestpractical Request Tracker=4.2.10

bestpractical Request Tracker=4.2.11

bestpractical Request Tracker=4.2.12

bestpractical Request Tracker=4.2.13

bestpractical Request Tracker=4.4.0

bestpractical Request Tracker=4.4.1

Event History

Jul 3, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6127?

CVE-2016-6127 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2016-6127?

To fix CVE-2016-6127, upgrade Request Tracker to versions 4.0.25 or later, 4.2.14 or later, or 4.4.2 or later.

Which versions of Request Tracker are affected by CVE-2016-6127?

CVE-2016-6127 affects Request Tracker versions 4.0.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2.

What kind of attack is possible with CVE-2016-6127?

CVE-2016-6127 allows remote attackers to inject arbitrary web scripts or HTML through a file upload.

Is there a workaround for CVE-2016-6127?

A temporary workaround for CVE-2016-6127 is to enable the AlwaysDownloadAttachments config setting until an upgrade is performed.