The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote attackers to obtain a logged-in session via unspecified vectors related to the URL of a RSS feed of the user.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Authen::externalauth | Mike_peachey | * | 0.08 (including) |
| Authen::externalauth | Mike_peachey | 0.05 (including) | 0.05 (including) |
| Rt-authen-externalauth | Ubuntu | quantal | * |
| Rt-authen-externalauth | Ubuntu | raring | * |
| Rt-authen-externalauth | Ubuntu | saucy | * |
| Rt-authen-externalauth | Ubuntu | upstream | * |
| Rt-authen-externalauth | Ubuntu | utopic | * |
| Rt-authen-externalauth | Ubuntu | vivid | * |
| Rt-authen-externalauth | Ubuntu | wily | * |
References
- http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html
- http://secunia.com/advisories/50060
- http://www.securityfocus.com/bid/54681
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77213
- http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html
- http://secunia.com/advisories/50060
- http://www.securityfocus.com/bid/54681
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77213