[rt-announce] Security vulnerability in RT::Extension::MobileUI
alexmv at bestpractical.com
Wed Jun 12 15:28:54 EDT 2013
Two of the May 2013 security vulnerabilities also affect the MobileUI
extension, which provides a mobile interface for RT versions 3.8.x. The
extension was merged with core RT starting in version 4.0.0, and the
respective vulnerabilies in RT 4.0.0 to 4.0.12 were fixed by the May
2013 patches and RT 4.0.13.
All versions of RT-Extension-MobileUI are vulnerable to cross-site
scripting (XSS) via attachment filenames. The vector is difficult to
exploit due to parsing requirements. This vulnerability is assigned
All versions of RT-Extension-MobileUI create a limited session re-use
vulnerability when using the file-based session store,
Apache::Session::File, in addition to an older version of various
non-core authentication extensions such as RT::Authen::ExternalAuth less
than version 0.14. The extent of session re-use is limited to
information leaks of certain user preferences and caches, such as queue
names available for ticket creation. This vulnerability is assigned
A new version of RT-Extension-MobileUI is available for download below.
The README in the tarball contains instructions for applying the
patches. If you need help resolving this issue locally, we will provide
discounted pricing for single-incident support; please contact us at
sales at bestpractical.com for more information.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 198 bytes
Desc: This is a digitally signed message part
More information about the rt-announce