CVE-2023-41259: Infoleak
Published Nov 3, 2023
·Updated
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
Affected Software
11 affected componentsFixes available
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~
4.4.2-2ubuntu0.1~
ubuntu/request-tracker4<4.4.3-2+
4.4.3-2+
ubuntu/request-tracker4<4.4.7
4.4.7
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
ubuntu/request-tracker5<5.0.5
5.0.5
debian/request-tracker4<=4.4.3-2+deb10u2, <=4.4.4+dfsg-2+deb11u2
4.4.3-2+deb10u34.4.4+dfsg-2+deb11u34.4.6+dfsg-1.1+deb12u14.4.7+dfsg-1
debian/request-tracker5
5.0.3+dfsg-3~deb12u25.0.5+dfsg-2
bestpractical Request Tracker<4.4.7
bestpractical Request Tracker>=5.0.0<5.0.5
Event History
Nov 3, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeaknessAffected Software
Dec 4, 2023
Data Sourced
09:08 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-41259.
2
What is the title of this vulnerability?
The title of this vulnerability is 'Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure'.
3
What is the severity of CVE-2023-41259?
The severity of CVE-2023-41259 is high with a severity value of 7.5.
4
What software versions are affected by CVE-2023-41259?
CVE-2023-41259 affects Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5.
5
How can I fix CVE-2023-41259?
To fix CVE-2023-41259, it is recommended to update Best Practical Request Tracker (RT) to version 4.4.7 or 5.0.5 depending on the installed version.