CVE-2017-5943

Опубликовано: 03 июл. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.

Ссылки

http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99384
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory
http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99384
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:bestpractical:request_tracker:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.00409

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2017-5943

CVSS3: 8.8

ubuntu

больше 8 лет назад

CVE-2017-5943

CVSS3: 8.8

debian

больше 8 лет назад

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x ...

GHSA-7p4g-wg5g-j4v4

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 61%

0.00409

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352