CVE-2015-5475 — Cross-site Scripting in Request-tracker4

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.4%
top 36.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Request-tracker4Bestpractical Request Tracker
Timeline
PublishedAug 14
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶debiandebian/request-tracker4< request-tracker4 4.2.11-2 (bookworm)

Patches

Patch: blog.bestpractical.com ↗Patch: bestpractical.com ↗Patch: blog.bestpractical.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wp66-gjc9-9vxx: Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4↗2022-05-17
▶
OSV
CVE-2015-5475: Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4↗2015-08-14
▶

📋Vendor Advisories

1
Debian
CVE-2015-5475: request-tracker4 - Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5475 rt: multiple XSS flaws [fedora-all]↗2015-08-17
▶
Bugzilla
CVE-2015-5475 CVE-2015-6506 rt: multiple XSS flaws↗2015-08-17
▶
CVE-2015-5475 — Cross-site Scripting | cvebase