Skip to main content

Fedora CVE-2015-1464

MEDIUM
Improper Access Control (CWE-284)
2015-03-09 cve@mitre.org
6.4
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
6.4 MEDIUM
AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N
Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
P
Availability
None

Lifecycle Timeline

1
CVE Published
Mar 09, 2015 - 14:59 cve.org
MEDIUM 6.4

DescriptionCVE.org

RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.

AnalysisAI

RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL. Affected products include: Fedoraproject Fedora, Bestpractical Request Tracker. Version information: before 4.0.23.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2013-3525 HIGH POC
7.5 May 10

SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute

CVE-2017-5944 HIGH
8.8 Jul 03

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.

CVE-2017-5943 HIGH
8.8 Jul 03

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain se

CVE-2023-45024 HIGH
7.5 Nov 03

Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transac

CVE-2023-41260 HIGH
7.5 Nov 03

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-g

CVE-2023-41259 HIGH
7.5 Nov 03

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed

CVE-2021-38562 HIGH
7.5 Oct 18

Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive informati

CVE-2014-9472 HIGH
7.1 Mar 09

The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote atta

CVE-2012-6579 MEDIUM
6.4 Jul 24

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers t

CVE-2016-6127 MEDIUM
6.1 Jul 03

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x befor

CVE-2022-25803 MEDIUM
6.1 Jul 14

Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. Rated medium severity (CVSS 6

CVE-2022-25802 MEDIUM
6.1 Jul 14

Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attac

Share

CVE-2015-1464 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy