CVEvulnerability
CVE-2017-5944
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
Affected configurations
• bestpractical request tracker 4.0.0
• bestpractical request tracker 4.0.1
• bestpractical request tracker 4.0.2
• bestpractical request tracker 4.0.3
• bestpractical request tracker 4.0.4
• bestpractical request tracker 4.0.5
• bestpractical request tracker 4.0.6
• bestpractical request tracker 4.0.7
• bestpractical request tracker 4.0.8
• bestpractical request tracker 4.0.9
• bestpractical request tracker 4.0.10
• bestpractical request tracker 4.0.11
• bestpractical request tracker 4.0.12
• bestpractical request tracker 4.0.13
• bestpractical request tracker 4.0.14
• bestpractical request tracker 4.0.15
• bestpractical request tracker 4.0.16
• bestpractical request tracker 4.0.17
• bestpractical request tracker 4.0.18
• bestpractical request tracker 4.0.19
• bestpractical request tracker 4.0.20
• bestpractical request tracker 4.0.21
• bestpractical request tracker 4.0.22
• bestpractical request tracker 4.0.23
• bestpractical request tracker 4.0.24
• bestpractical request tracker 4.2.0
• bestpractical request tracker 4.2.1
• bestpractical request tracker 4.2.2
• bestpractical request tracker 4.2.3
• bestpractical request tracker 4.2.4
• bestpractical request tracker 4.2.5
• bestpractical request tracker 4.2.6
• bestpractical request tracker 4.2.7
• bestpractical request tracker 4.2.8
• bestpractical request tracker 4.2.9
• bestpractical request tracker 4.2.10
• bestpractical request tracker 4.2.11
• bestpractical request tracker 4.2.12
• bestpractical request tracker 4.2.13
• bestpractical request tracker 4.4.0
• bestpractical request tracker 4.4.1
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.debian.org/security/2017/dsa-3882 Third Party Advisory
- http://www.securityfocus.com/bid/99381 Third Party Advisory, VDB Entry
- https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 Vendor Advisory
- http://www.debian.org/security/2017/dsa-3882 Third Party Advisory
- http://www.securityfocus.com/bid/99381 Third Party Advisory, VDB Entry
- https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 Vendor Advisory