RT Security Advisory: Multiple CVEs (Email Injection, Privilege Escalation, CSRF, RCE)

Critical Vulnerability Information Vulnerability Details CVE-2012-4730: - Affected Versions: All versions of RT - Vulnerability Type: Email Header Injection Attack - Impact Description: Users can add arbitrary headers or content to outgoing emails via ModifySelf or AdminUser, potentially leading to information leakage or phishing attacks. CVE-2012-4731: - Affected Versions: RT 4.0.0 and above, RTFM 2.0.0 and above - Vulnerability Type: Missing Permission Checks - Impact Description: Any privileged user can create articles in any class. CVE-2012-4732: - Affected Versions: All RT versions with CSRF protection enabled (RT 3.8.12 and above, RT 4.0.6 and above) - Vulnerability Type: CSRF Vulnerability - Impact Description: Incorrectly allows CSRF requests to toggle ticket certificate signing. CVE-2012-4734: - Affected Versions: All RT versions - Vulnerability Type: Confused Deputy Attack - Impact Description: Unauthenticated users can be attacked via malicious links; after providing credentials, attackers may modify any ticket status. CVE-2012-4735: - Affected Versions: RT 3.8.0 and above - Vulnerability Type: Improper Security for GnuPG Signed and Encrypted Messages - Impact Description: Automatically generated messages may no longer provide authenticity guarantees. CVE-2012-4884: - Affected Versions: RT 3.8.0 and above with GnuPG enabled - Vulnerability Type: Users can pass arbitrary parameters via command-line GnuPG client - Impact Description: This vulnerability can be exploited to create arbitrary files with the privileges of the web server. Remediation RT 3.8.15 and RT 4.0.8 have been released to address these issues, including RTFM 2.4.5 as a patch version. Patch packages are available for download, corresponding to all 3.8.x and 4.0.x versions. RT 3.6.x has reached end-of-life and is no longer supported with patches.

Goal Reached Thanks to every supporter — we hit 100%!

RT Security Advisory: Multiple CVEs (Email Injection, Privilege Escalation, CSRF, RCE)