CVE-2021-38562

🗓️ 18 Oct 2021 08:52:58Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 179 Views

Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm

Reporter	Title	Published	Views	Family All 42
AlpineLinux	CVE-2021-38562	18 Oct 202108:52	–	alpinelinux
Circl	CVE-2021-38562	18 Oct 202112:36	–	circl
CNNVD	Best Practical Request Tracker 信息泄露漏洞	18 Oct 202100:00	–	cnnvd
Cvelist	CVE-2021-38562	18 Oct 202108:52	–	cvelist
Debian	[SECURITY] [DLA 3057-1] request-tracker4 security update	23 Jun 202207:42	–	debian
Debian CVE	CVE-2021-38562	18 Oct 202108:52	–	debiancve
Tenable Nessus	Debian DLA-3057-1 : request-tracker4 - LTS security update	23 Jun 202200:00	–	nessus
Tenable Nessus	Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Request Tracker vulnerabilities (USN-6529-1)	4 Dec 202300:00	–	nessus
Tenable Nessus	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : Request Tracker vulnerabilities (USN-7692-1)	19 Aug 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2021-38562	30 Aug 202500:00	–	nessus

NVD

Node

bestpractical request_trackerRange4.2.0–4.2.17

bestpractical request_trackerRange4.4.0–4.4.5

bestpractical request_trackerRange5.0.0–5.0.2

Node

fedoraproject fedoraMatch35

Node

debian debian_linuxMatch9.0

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2022/06/msg00019.html
github	www.github.com/bestpractical/rt/commit/70749bb66cb13dd70bd53340c371038a5f3ca57c
docs	www.docs.bestpractical.com/release-notes/rt/index.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JK57CEEXLQF7MGBCUX76DZHXML7LUSQ/

21 Nov 2024 06:17Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.17.5

EPSS0.00102

CWE-203