Vulnerability Details : CVE-2016-6127
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2016-6127
- cpe:2.3:a:bestpractical:request_tracker:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:request_tracker:4.2.13:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-6127
0.32%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-6127
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2016-6127
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-6127
-
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Security vulnerabilities in RT (2017-06-15) - RT Users - Request Tracker Community ForumVendor Advisory
-
http://www.debian.org/security/2017/dsa-3882
Debian -- Security Information -- DSA-3882-1 request-tracker4Third Party Advisory
-
http://www.securityfocus.com/bid/99375
Request Tracker CVE-2016-6127 Cross Site Scripting VulnerabilityThird Party Advisory;VDB Entry
Jump to