FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

p5-RT-Authen-ExternalAuth -- privilege escalation

Affected packages
		p5-RT-Authen-ExternalAuth	<	0.11

Details

VuXML ID	cdc4ff0e-d736-11e1-8221-e0cb4e266481
Discovery	2012-07-25
Entry	2012-07-26

The RT development team reports:

RT::Authen::ExternalAuth 0.10 and below (for all versions of RT) are vulnerable to an escalation of privilege attack where the URL of a RSS feed of the user can be used to acquire a fully logged-in session as that user. CVE-2012-2770 has been assigned to this vulnerability.

Users of RT 3.8.2 and above should upgrade to RT::Authen::ExternalAuth 0.11, which resolves this vulnerability.

[source]

References

CVE Name	CVE-2012-2770
URL	http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html