{"id":"CVE-2024-3262","state":"PUBLISHED","title":"Information exposure vulnerability in Request Tracker (RT)","description":"Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination.","publishedAt":"2024-04-04T09:21:34.682Z","updatedAt":"2025-11-03T19:29:47.007Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["Best Practical Solutions Request Tracker"],"affected":[{"vendor":"Best Practical Solutions","product":"Request Tracker","defaultStatus":"unaffected","versions":[{"version":"4.4.1","status":"affected"}]}],"references":["https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidad-de-exposicion-de-informacion-en-request-tracker-rt","https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3262.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-3262","state":"PUBLISHED","datePublished":"2024-04-04T09:21:34.682Z","dateUpdated":"2025-11-03T19:29:47.007Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-04-03T09:53:11.218Z"},"containers":{"cna":{"title":"Information exposure vulnerability in Request Tracker (RT)","descriptions":[{"lang":"en","value":"Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination."}],"affected":[{"vendor":"Best Practical Solutions","product":"Request Tracker","defaultStatus":"unaffected","versions":[{"version":"4.4.1","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidad-de-exposicion-de-informacion-en-request-tracker-rt"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-04-04T09:21:34.682Z"},"credits":[{"lang":"en","type":"finder","value":"Javier Garcia Antón"}],"datePublic":"2024-04-04T10:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Vulnerability fixed by applying the following patches: <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/bestpractical/rt/commit/ea07e767eaef5b202e8883051616d09806b8b48a.patch\">https://github.com/bestpractical/rt/commit/ea07e767eaef5b202e8883051616d09806b8b48a.patch</a> and <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/bestpractical/rt/commit/468f86bd3e82c3b5b5ef7087d416a7509d4b1abe.patch\">https://github.com/bestpractical/rt/commit/468f86bd3e82c3b5b5ef7087d416a7509d4b1abe.patch</a>. In future versions of RT, this solution will be included as a configurable option of the tool."}],"value":"Vulnerability fixed by applying the following patches:  https://github.com/bestpractical/rt/commit/ea07e767eaef5b202e8883051616d09806b8b48a.patch  and  https://github.com/bestpractical/rt/commit/468f86bd3e82c3b5b5ef7087d416a7509d4b1abe.patch . In future versions of RT, this solution will be included as a configurable option of the tool."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3262","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-04T15:30:10.688608Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:32:14.816Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidad-de-exposicion-de-informacion-en-request-tracker-rt","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:29:47.007Z"}}]}}}