CVE-2017-5944: Input Validation

Published Jul 3, 2017

Updated

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Affected Software

41 affected components

bestpractical Request Tracker=4.0.0

bestpractical Request Tracker=4.0.1

bestpractical Request Tracker=4.0.2

bestpractical Request Tracker=4.0.3

bestpractical Request Tracker=4.0.4

bestpractical Request Tracker=4.0.5

bestpractical Request Tracker=4.0.6

bestpractical Request Tracker=4.0.7

bestpractical Request Tracker=4.0.8

bestpractical Request Tracker=4.0.9

bestpractical Request Tracker=4.0.10

bestpractical Request Tracker=4.0.11

bestpractical Request Tracker=4.0.12

bestpractical Request Tracker=4.0.13

bestpractical Request Tracker=4.0.14

bestpractical Request Tracker=4.0.15

bestpractical Request Tracker=4.0.16

bestpractical Request Tracker=4.0.17

bestpractical Request Tracker=4.0.18

bestpractical Request Tracker=4.0.19

bestpractical Request Tracker=4.0.20

bestpractical Request Tracker=4.0.21

bestpractical Request Tracker=4.0.22

bestpractical Request Tracker=4.0.23

bestpractical Request Tracker=4.0.24

bestpractical Request Tracker=4.2.0

bestpractical Request Tracker=4.2.1

bestpractical Request Tracker=4.2.2

bestpractical Request Tracker=4.2.3

bestpractical Request Tracker=4.2.4

bestpractical Request Tracker=4.2.5

bestpractical Request Tracker=4.2.6

bestpractical Request Tracker=4.2.7

bestpractical Request Tracker=4.2.8

bestpractical Request Tracker=4.2.9

bestpractical Request Tracker=4.2.10

bestpractical Request Tracker=4.2.11

bestpractical Request Tracker=4.2.12

bestpractical Request Tracker=4.2.13

bestpractical Request Tracker=4.4.0

bestpractical Request Tracker=4.4.1

Event History

Jul 3, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-5944?

CVE-2017-5944 has been classified as a critical vulnerability as it allows remote authenticated users to execute arbitrary code.

How do I fix CVE-2017-5944?

To fix CVE-2017-5944, upgrade Request Tracker to versions 4.0.25, 4.2.14, or 4.4.2 and later.

Who is affected by CVE-2017-5944?

CVE-2017-5944 affects Request Tracker versions 4.0.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2.

What type of vulnerability is CVE-2017-5944?

CVE-2017-5944 is an arbitrary code execution vulnerability due to improper handling of crafted saved search names.

Can remote users exploit CVE-2017-5944?

Yes, authenticated remote users with certain privileges can exploit CVE-2017-5944.