CVE-2015-5475

Description

Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.

References

https://bestpractical.com/release-notes/rt/4.2.12

http://www.securityfocus.com/bid/76364

http://www.debian.org/security/2015/dsa-3335

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165163.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165124.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164607.html

http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3