CVE-2024-3262: Information exposure vulnerability in Request Tracker (RT)

Published Apr 4, 2024

Updated

Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.

Affected Software

1 affected component

Best Practical Solutions Request Tracker

Remediation

Information

Vulnerability fixed by applying the following patches: https://github.com/bestpractical/rt/commit/ea07e767eaef5b202e8883051616d09806b8b48a.patch and https://github.com/bestpractical/rt/commit/468f86bd3e82c3b5b5ef7087d416a7509d4b1abe.patch . In future versions of RT, this solution will be included as a configurable option of the tool.

Event History

Apr 4, 2024

CVE Published

via MITRE·09:21 AM

Data Sourced

via MITRE·09:21 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-3262?

CVE-2024-3262 is considered a moderate severity vulnerability due to its potential for information exposure.

How do I fix CVE-2024-3262?

To fix CVE-2024-3262, upgrade the Request Tracker software to at least version 4.4.2, which resolves the information exposure issue.

What applications are affected by CVE-2024-3262?

CVE-2024-3262 affects Request Tracker version 4.4.1 developed by Best Practical Solutions.

What type of information is exposed in CVE-2024-3262?

CVE-2024-3262 allows attackers with local access to retrieve sensitive information, including vulnerability tickets stored by the application.

Who can exploit CVE-2024-3262?

CVE-2024-3262 can be exploited by attackers who have local access to the affected system.