CVE-2023-41260: Infoleak
Published Nov 3, 2023
·Updated
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
Affected Software
11 affected componentsFixes available
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~
4.4.2-2ubuntu0.1~
ubuntu/request-tracker4<4.4.3-2+
4.4.3-2+
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
ubuntu/request-tracker4<4.4.7
4.4.7
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
ubuntu/request-tracker5<5.0.5
5.0.5
debian/request-tracker4<=4.4.3-2+deb10u2, <=4.4.4+dfsg-2+deb11u2
4.4.3-2+deb10u34.4.4+dfsg-2+deb11u34.4.6+dfsg-1.1+deb12u14.4.7+dfsg-1
debian/request-tracker5
5.0.3+dfsg-3~deb12u25.0.5+dfsg-2
bestpractical Request Tracker<4.4.7
bestpractical Request Tracker>=5.0.0<5.0.5
Event History
Nov 3, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeaknessAffected Software
Dec 4, 2023
Data Sourced
09:08 PM
Description
Frequently Asked Questions
1
What is CVE-2023-41260?
CVE-2023-41260 is a vulnerability in Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 that allows information exposure in responses to mail-gateway REST API calls.
2
What is the severity of CVE-2023-41260?
The severity of CVE-2023-41260 is high with a CVSS score of 7.5.
3
Which software versions are affected by CVE-2023-41260?
Best Practical Request Tracker versions before 4.4.7 and 5.x before 5.0.5 are affected by CVE-2023-41260.
4
How can I fix CVE-2023-41260?
To fix CVE-2023-41260, users should update to Best Practical Request Tracker version 4.4.7 or 5.0.5 or later.
5
Where can I find more information about CVE-2023-41260?
More information about CVE-2023-41260 can be found in the release notes of Best Practical Request Tracker versions 4.4.7 and 5.0.5.