CVE-2023-45024: 
Linux Debian vulnerability analysis and mitigation

Best Practical Request Tracker (RT) 5 before version 5.0.5 contains an Information Disclosure vulnerability (CVE-2023-45024) that allows unauthorized access to sensitive information via a transaction search in the transaction query builder. The vulnerability was discovered and fixed in October 2023, affecting Request Tracker versions from 5.0.0 up to (but not including) 5.0.5 (RT Release Notes).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in high confidentiality impact without affecting integrity or availability (NVD).

The vulnerability allows authenticated users to potentially access sensitive information through transaction searches made in the transaction query builder. This information disclosure could expose confidential data to unauthorized users within the system (RT Release Notes).

The vulnerability has been fixed in Request Tracker version 5.0.5. Organizations using affected versions should upgrade to version 5.0.5 or later to address this security issue. The fix was released on October 19, 2023, as part of the RT 5.0.5 release (RT Release Notes).