Vulnerability · Published Apr 4, 2024 · Assigned by INCIBE
CVE-2024-3262Information exposure vulnerability in Request Tracker (RT)
Medium 5.5
In plain English
A medium-severity information exposure in Request Tracker from Best Practical Solutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | request-tracker4 | 4.4.6+dfsg-1.1+deb12u2 | DEBIAN-CVE-2024-3262 |
| Debian:12 | request-tracker4 | 4.4.6+dfsg-1.1+deb12u2 | DSA-5911-1 |
| Debian:12 | request-tracker5 | 5.0.3+dfsg-3~deb12u3 | DSA-5909-1 |
| Debian:12 | request-tracker5 | 5.0.3+dfsg-3~deb12u3 | DEBIAN-CVE-2024-3262 |
| Debian:13 | request-tracker5 | 5.0.7+dfsg-1 | DEBIAN-CVE-2024-3262 |
| Debian:14 | request-tracker5 | 5.0.7+dfsg-1 | DEBIAN-CVE-2024-3262 |
| Ubuntu:22.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-3262 |
| Ubuntu:24.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-3262 |
| Ubuntu:25.10 | request-tracker4 | no fix listed | UBUNTU-CVE-2024-3262 |
| Ubuntu:26.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2024-3262 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Best Practical Solutions | Request Tracker | 4.4.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N