medium6.4
CVE-2015-1464
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Impact
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fedoraproject | Fedora | Versions 21, 22 |
| Bestpractical | Request Tracker | through 4.0.22 Versions 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
- http://www.debian.org/security/2015/dsa-3176
- http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
- http://www.debian.org/security/2015/dsa-3176