Cross-Site Scripting Flaw in Request Tracker by Best Practical

CVE-2013-5587

What is CVE-2013-5587?

A cross-site scripting (XSS) vulnerability exists in Request Tracker (RT) versions prior to 4.0.13 when the MakeClicky feature is enabled. This flaw allows remote attackers to inject arbitrary web scripts or HTML through manipulated URLs in tickets. Consequently, attackers can exploit this vulnerability to execute malicious scripts in the context of an authenticated user's browser, leading to session hijacking and unauthorized actions.

References