RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
2015-03-09T14:59:06.450
2025-04-12T10:46:40.837
Deferred
CVSSv2: 6.4 (MEDIUM)
AV:N/AC:L/Au:N/C:P/I:P/A:N
10.0
4.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | fedoraproject | fedora | 21 | Yes |
| Operating System | fedoraproject | fedora | 22 | Yes |
| Application | bestpractical | request_tracker | ≤ 4.0.22 | Yes |
| Application | bestpractical | request_tracker | 4.2.0 | Yes |
| Application | bestpractical | request_tracker | 4.2.1 | Yes |
| Application | bestpractical | request_tracker | 4.2.2 | Yes |
| Application | bestpractical | request_tracker | 4.2.3 | Yes |
| Application | bestpractical | request_tracker | 4.2.4 | Yes |
| Application | bestpractical | request_tracker | 4.2.5 | Yes |
| Application | bestpractical | request_tracker | 4.2.6 | Yes |
| Application | bestpractical | request_tracker | 4.2.7 | Yes |
| Application | bestpractical | request_tracker | 4.2.8 | Yes |
| Application | bestpractical | request_tracker | 4.2.9 | Yes |