CVE-2015-1464: Bestpractical Request Tracker

Medium severity, CVSS 6.4. EPSS: 2% chance of exploitation in the next 30 days.

RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.

Affected products

• Bestpractical Request Tracker: up to and including 4.0.22; version 4.2.0 only; version 4.2.1 only; version 4.2.2 only; version 4.2.3 only; version 4.2.4 only; …
• Fedoraproject Fedora: version 21 only; version 22 only

Published 2015-03-09. Last modified 2026-06-17.