CVE-2017-5944: Input Validation
First published: Mon Jul 03 2017(Updated: )
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Request Tracker | =4.0.0 | |
| Request Tracker | =4.0.1 | |
| Request Tracker | =4.0.2 | |
| Request Tracker | =4.0.3 | |
| Request Tracker | =4.0.4 | |
| Request Tracker | =4.0.5 | |
| Request Tracker | =4.0.6 | |
| Request Tracker | =4.0.7 | |
| Request Tracker | =4.0.8 | |
| Request Tracker | =4.0.9 | |
| Request Tracker | =4.0.10 | |
| Request Tracker | =4.0.11 | |
| Request Tracker | =4.0.12 | |
| Request Tracker | =4.0.13 | |
| Request Tracker | =4.0.14 | |
| Request Tracker | =4.0.15 | |
| Request Tracker | =4.0.16 | |
| Request Tracker | =4.0.17 | |
| Request Tracker | =4.0.18 | |
| Request Tracker | =4.0.19 | |
| Request Tracker | =4.0.20 | |
| Request Tracker | =4.0.21 | |
| Request Tracker | =4.0.22 | |
| Request Tracker | =4.0.23 | |
| Request Tracker | =4.0.24 | |
| Request Tracker | =4.2.0 | |
| Request Tracker | =4.2.1 | |
| Request Tracker | =4.2.2 | |
| Request Tracker | =4.2.3 | |
| Request Tracker | =4.2.4 | |
| Request Tracker | =4.2.5 | |
| Request Tracker | =4.2.6 | |
| Request Tracker | =4.2.7 | |
| Request Tracker | =4.2.8 | |
| Request Tracker | =4.2.9 | |
| Request Tracker | =4.2.10 | |
| Request Tracker | =4.2.11 | |
| Request Tracker | =4.2.12 | |
| Request Tracker | =4.2.13 | |
| Request Tracker | =4.4.0 | |
| Request Tracker | =4.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-5944?
CVE-2017-5944 has been classified as a critical vulnerability as it allows remote authenticated users to execute arbitrary code.
How do I fix CVE-2017-5944?
To fix CVE-2017-5944, upgrade Request Tracker to versions 4.0.25, 4.2.14, or 4.4.2 and later.
Who is affected by CVE-2017-5944?
CVE-2017-5944 affects Request Tracker versions 4.0.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2.
What type of vulnerability is CVE-2017-5944?
CVE-2017-5944 is an arbitrary code execution vulnerability due to improper handling of crafted saved search names.
Can remote users exploit CVE-2017-5944?
Yes, authenticated remote users with certain privileges can exploit CVE-2017-5944.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/bestpractical
- canonical/request tracker
- version/request tracker/4.0.0
- version/request tracker/4.0.1
- version/request tracker/4.0.2
- version/request tracker/4.0.3
- version/request tracker/4.0.4
- version/request tracker/4.0.5
- version/request tracker/4.0.6
- version/request tracker/4.0.7
- version/request tracker/4.0.8
- version/request tracker/4.0.9
- version/request tracker/4.0.10
- version/request tracker/4.0.11
- version/request tracker/4.0.12
- version/request tracker/4.0.13
- version/request tracker/4.0.14
- version/request tracker/4.0.15
- version/request tracker/4.0.16
- version/request tracker/4.0.17
- version/request tracker/4.0.18
- version/request tracker/4.0.19
- version/request tracker/4.0.20
- version/request tracker/4.0.21
- version/request tracker/4.0.22
- version/request tracker/4.0.23
- version/request tracker/4.0.24
- version/request tracker/4.2.0
- version/request tracker/4.2.1
- version/request tracker/4.2.2
- version/request tracker/4.2.3
- version/request tracker/4.2.4
- version/request tracker/4.2.5
- version/request tracker/4.2.6
- version/request tracker/4.2.7
- version/request tracker/4.2.8
- version/request tracker/4.2.9
- version/request tracker/4.2.10
- version/request tracker/4.2.11
- version/request tracker/4.2.12
- version/request tracker/4.2.13
- version/request tracker/4.4.0
- version/request tracker/4.4.1