CVE-2016-6127

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-03 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.

Affected products

Best Practical Request Tracker: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+35)

References

http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99375
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99375
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016

Get alerted when CVE-2016-6127 or the next vulnerability affects your stack