CVE-2023-41259

Name of the Vulnerable Software and Affected Versions Best Practical Request Tracker (RT) versions 4.4.6 and earlier Best Practical Request Tracker (RT) versions 5.0.4 and earlier

Description The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. This is due to insufficient cleaning of user-provided data when processing email headers. Exploitation of the issue may allow a remote attacker to execute arbitrary HTML code by sending a specially crafted email message.

Recommendations For versions 4.4.6 and earlier, update to version 4.4.7 or later. For versions 5.0.4 and earlier, update to version 5.0.5 or later. As a temporary workaround, consider restricting access to the mail-gateway REST API call until a patch is available.