CVE-2016-6127

Опубликовано: 03 июл. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.

Ссылки

http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99375
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory
http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99375
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:bestpractical:request_tracker:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00324

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2016-6127

CVSS3: 6.1

ubuntu

больше 8 лет назад

CVE-2016-6127

CVSS3: 6.1

debian

больше 8 лет назад

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x b ...

GHSA-57pq-pp54-cgmc

CVSS3: 6.1

github

больше 3 лет назад

EPSS

Процентиль: 55%

0.00324

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79