Cloudanix VulnDB

CVE-2023-41260

High · 7.5

CVSS

7.5

EPSS

0.9%

Published

Nov 3, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in support ticket software could let outsiders see private customer information through certain web requests.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw exposes sensitive information in responses to unauthenticated mail-gateway REST API calls in Request Tracker.

Why it matters to the business

Attackers may access confidential data such as support tickets or user details, leading to privacy breaches and compliance issues.

How an attack unfolds

An attacker discovers an internet-facing Request Tracker instance and sends HTTP requests to the mail-gateway endpoint, receiving unintended data in the API responses.

How to fix it

Upgrade Request Tracker to version 4.4.7 or 5.0.5 or later. For Debian 11 systems, update to package version 5.10.216-1 or newer.

How to confirm the fix worked

Verify the installed version is at or above the fixed versions and test that mail-gateway API responses no longer include sensitive data.

Typical attack path

  1. Locate a vulnerable Request Tracker deployment via network scanning
  2. Craft and send requests to the mail-gateway REST API without authentication
  3. Inspect response bodies for exposed sensitive information

How to detect it

Examine web server access logs for requests to mail-gateway endpoints and monitor for unusually large or unexpected response payloads that may indicate data leakage.

What your security team should do

  • Prioritize patching all instances of Request Tracker to the fixed package versions
  • Review web server logs for anomalous requests to mail-gateway endpoints
  • Restrict network access to the RT server to trusted sources only

The record

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 request-tracker4 0 4.4.3-2+deb10u3
Debian:11 request-tracker4 0 4.4.4+dfsg-2+deb11u3
Debian:12 request-tracker4 0 4.4.6+dfsg-1.1+deb12u1
Debian:12 request-tracker5 0 5.0.3+dfsg-3~deb12u2
Debian:13 request-tracker4 0 4.4.7+dfsg-1
Debian:13 request-tracker5 0 5.0.5+dfsg-1
Debian:14 request-tracker5 0 5.0.5+dfsg-1
Ubuntu:16.04:LTS request-tracker4 0 No fix
Ubuntu:20.04:LTS request-tracker4 0 4.4.3-2+deb10u3build0.20.04.1
Ubuntu:22.04:LTS request-tracker4 0 4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu:22.04:LTS request-tracker5 0 No fix
Ubuntu:23.10 request-tracker4 0 4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu:24.04:LTS request-tracker4 0 No fix
Ubuntu:24.04:LTS request-tracker5 0 No fix
Ubuntu:24.10 request-tracker5 0 5.0.5+dfsg-2
Ubuntu:Pro:16.04:LTS request-tracker4 0 No fix
Ubuntu:Pro:18.04:LTS request-tracker4 0 4.4.2-2ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS request-tracker5 0 5.0.1+dfsg-1ubuntu1+esm1

Related vulnerabilities