Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bestpractical | Request Tracker | <= 4.2.11 |
Related Weaknesses (CWE)
References
- http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.htmlPatchVendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.htm
- http://www.debian.org/security/2015/dsa-3335
- http://www.securityfocus.com/bid/76364
- https://bestpractical.com/release-notes/rt/4.2.12PatchVendor Advisory
- http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.htmlPatchVendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.htm
- http://www.debian.org/security/2015/dsa-3335
- http://www.securityfocus.com/bid/76364
- https://bestpractical.com/release-notes/rt/4.2.12PatchVendor Advisory
FAQ
What is CVE-2015-5475?
CVE-2015-5475 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) ...
How severe is CVE-2015-5475?
CVE-2015-5475 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-5475?
Check the references section above for vendor advisories and patch information. Affected products include: Bestpractical Request Tracker.