Lucene search

MitreCVE-2021-38562

HistoryOct 18, 2021 - 9:15 a.m.

CVE-2021-38562

2021-10-1809:15:08

CWE-203

mitre

web.nvd.nist.gov

133

cve-2021-38562

information security

request tracker

timing attack

sensitive information disclosure

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

71.3%

JSON

Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.

Affected configurations

Nvd

Node

bestpracticalrequest_trackerRange4.2.0–4.2.17

bestpracticalrequest_trackerRange4.4.0–4.4.5

bestpracticalrequest_trackerRange5.0.0–5.0.2

Node

fedoraprojectfedoraMatch35

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
bestpracticalrequest_tracker*cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bestpractical	request_tracker	*	cpe:2.3:a:bestpractical:request_tracker::::::::
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*