CVE-2023-41259

7.5 highEPSS 0.9%

High (7.5) in bestpractical request tracker. EPSS 0.9% chance of exploitation in the next 30 days.

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2023-11-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bestpractical:request_tracker

References

https://docs.bestpractical.com/release-notes/rt/4.4.7
https://docs.bestpractical.com/release-notes/rt/5.0.5
https://docs.bestpractical.com/release-notes/rt/index.html
https://docs.bestpractical.com/release-notes/rt/4.4.7
https://docs.bestpractical.com/release-notes/rt/5.0.5

Check your stack JSON