CVE-2024-3262 Information exposure vulnerability in Request Tracker (RT)
Local attackers can retrieve sensitive application data from the browser cache after session termination, exposing vulnerability tickets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3262?
CVE-2024-3262 is a medium-severity vulnerability in Best Practical Solutions Request Tracker, published on 4 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.
Weakness: CWE-200
Which versions are affected by CVE-2024-3262?
How do I fix CVE-2024-3262?
Upgrade to a fixed version.
Is CVE-2024-3262 being exploited?
There is no known exploitation of CVE-2024-3262 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-3262, GHSA-6426-p644-ffcf, UBUNTU-CVE-2024-3262.