CVE-2024-3262: 
Linux Debian vulnerability analysis and mitigation

Information exposure vulnerability in RT (Request Tracker) software affecting version 4.4.1. This vulnerability was discovered by Javier Garcia Antón and was assigned CVE-2024-3262. The vulnerability was disclosed on April 4, 2024, with a CVSS v3.1 base score of 5.5 (Medium) (INCIBE Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability has a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access is required, low attack complexity, low privileges required, no user interaction needed, and high confidentiality impact (INCIBE Advisory).

The vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets. This information exposure persists even after session termination due to the application storing information in the browser cache (Debian Tracker).

The vulnerability requires local access to the affected system with low privileges to be exploited. No known exploits in the wild have been reported at this time (INCIBE Advisory).

The vulnerability has been fixed through patches available at GitHub. The solution will be included as a configurable option in future RT versions. The specific patches can be applied from the following commits: ea07e767eaef5b202e8883051616d09806b8b48a and 468f86bd3e82c3b5b5ef7087d416a7509d4b1abe (INCIBE Advisory).