CVE-2023-41259 | Vulnerability Database | Aqua Security

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.

Affected Software

Name	Vendor	Start Version	End Version
Request_tracker	Bestpractical	*	4.4.7 (excluding)
Request_tracker	Bestpractical	5.0.0 (including)	5.0.5 (excluding)
Request-tracker4	Ubuntu	bionic	*
Request-tracker4	Ubuntu	esm-apps/bionic	*
Request-tracker4	Ubuntu	esm-apps/noble	*
Request-tracker4	Ubuntu	esm-apps/xenial	*
Request-tracker4	Ubuntu	focal	*
Request-tracker4	Ubuntu	jammy	*
Request-tracker4	Ubuntu	lunar	*
Request-tracker4	Ubuntu	mantic	*
Request-tracker4	Ubuntu	noble	*
Request-tracker4	Ubuntu	trusty	*
Request-tracker4	Ubuntu	upstream	*
Request-tracker4	Ubuntu	xenial	*
Request-tracker5	Ubuntu	bionic	*
Request-tracker5	Ubuntu	lunar	*
Request-tracker5	Ubuntu	mantic	*
Request-tracker5	Ubuntu	trusty	*
Request-tracker5	Ubuntu	upstream	*
Request-tracker5	Ubuntu	xenial	*

References

https://docs.bestpractical.com/release-notes/rt/4.4.7
https://docs.bestpractical.com/release-notes/rt/5.0.5
https://docs.bestpractical.com/release-notes/rt/index.html

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41259
CWE	https://cwe.mitre.org/data/definitions/.html