Fluid Attacks Database

Description

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	request-tracker5	>=0 <5.0.5+dfsg-1	5.0.5+dfsg-1
debian 11	request-tracker4	=4.4.4+dfsg-2 \|\| =4.4.4+dfsg-2+deb11u1 \|\| =4.4.4+dfsg-2+deb11u2 \|\| >=0 <4.4.4+dfsg-2+deb11u3	4.4.4+dfsg-2+deb11u3
debian 12	request-tracker4	=4.4.6+dfsg-1.1 \|\| >=0 <4.4.6+dfsg-1.1+deb12u1	4.4.6+dfsg-1.1+deb12u1
debian 12	request-tracker5	=5.0.3+dfsg-2 \|\| =5.0.3+dfsg-3~deb12u1 \|\| >=0 <5.0.3+dfsg-3~deb12u2	5.0.3+dfsg-3~deb12u2
debian 13	request-tracker5	>=0 <5.0.5+dfsg-1	5.0.5+dfsg-1

Aliases

1. CVE-2023-412592. NVD-2023-412593. OSV-DEBIAN-2023-412594. OSV-2023-412595. SECURITY-TRACKER-CVE-2023-41259

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.