CVE-2017-5944

Опубликовано: 03 июл. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Ссылки

http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99381
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory
http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.securityfocus.com/bid/99381
Third Party Advisory
VDB Entry
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:bestpractical:request_tracker:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04438

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2017-5944

CVSS3: 8.8

ubuntu

больше 8 лет назад

CVE-2017-5944

CVSS3: 8.8

debian

больше 8 лет назад

The dashboard subscription interface in Request Tracker (RT) 4.x befor ...

GHSA-fcc9-mfrp-452q

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 89%

0.04438

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-20