CVE-2017-5944

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-03 · updated 2026-06-17
Weakness: CWE-20

Description

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Affected products

Best Practical Request Tracker: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+35)

References

http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99381
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99381
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016

Get alerted when CVE-2017-5944 or the next vulnerability affects your stack