CVE-2017-5944

8.8 highEPSS 2.8%

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bestpractical:request_tracker

References

http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99381
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99381

Check your stack JSON