| Package | Affected versions | Patched versions |
|---|---|---|
| rt | = 3.8.0= 3.8.1= 3.8.10= 3.8.11= 3.8.12= 3.8.13= 3.8.14= 3.8.2= 3.8.3= 3.8.4= 3.8.5= 3.8.6= 3.8.7= 3.8.8= 3.8.9= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.0.8 |
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free