CVE-2024-3262: Information exposure vulnerability in Request Tracker (RT)
First published: Thu Apr 04 2024(Updated: )
Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.
Credit: cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Request Tracker |
Remedy
Vulnerability fixed by applying the following patches: https://github.com/bestpractical/rt/commit/ea07e767eaef5b202e8883051616d09806b8b48a.patch and https://github.com/bestpractical/rt/commit/468f86bd3e82c3b5b5ef7087d416a7509d4b1abe.patch . In future versions of RT, this solution will be included as a configurable option of the tool.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3262?
CVE-2024-3262 is considered a moderate severity vulnerability due to its potential for information exposure.
How do I fix CVE-2024-3262?
To fix CVE-2024-3262, upgrade the Request Tracker software to at least version 4.4.2, which resolves the information exposure issue.
What applications are affected by CVE-2024-3262?
CVE-2024-3262 affects Request Tracker version 4.4.1 developed by Best Practical Solutions.
What type of information is exposed in CVE-2024-3262?
CVE-2024-3262 allows attackers with local access to retrieve sensitive information, including vulnerability tickets stored by the application.
Who can exploit CVE-2024-3262?
CVE-2024-3262 can be exploited by attackers who have local access to the affected system.
- agent/remedy
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/best practical solutions
- canonical/request tracker