Request Tracker is prone to an information-disclosure vulnerability because it fails to securely store passwords. Successful attacks can allow a local attacker to gain access to the stored passwords. Request Tracker 3.6.x and 3.8.x are affected other versions may also be vulnerable.

Updates are available. Please see the references for details.

• http://www.bestpractical.com/rt/
• https://www.securityfocus.com/bid/45959

---

Updated on 2015-03-25