CVE-2023-41259

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
best_practical_solutions	request_tracker	< 4.4.7; >= 5x, < 5.0.5

References

https://docs.bestpractical.com/release-notes/rt/4.4.7Release Notes, Vendor Advisory
https://docs.bestpractical.com/release-notes/rt/5.0.5Release Notes, Vendor Advisory
https://docs.bestpractical.com/release-notes/rt/index.htmlRelease Notes, Vendor Advisory
https://docs.bestpractical.com/release-notes/rt/4.4.7Release Notes, Vendor Advisory
https://docs.bestpractical.com/release-notes/rt/5.0.5Release Notes, Vendor Advisory
https://docs.bestpractical.com/release-notes/rt/index.htmlRelease Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00046.html

Timeline

Published: Nov 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-41268.8Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.CVE-2023-412607.5Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API call CVE-2023-412615.3An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does n CVE-2023-412629.8An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vul CVE-2023-412633.7An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With kn CVE-2023-412649.8Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, l CVE-2023-412659.9An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 CVE-2023-412666.5A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a CVE-2023-412677.8In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As thi CVE-2023-412689.8Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects Esc CVE-2023-41275.9Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.CVE-2023-412704.3Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before al