CVE-2017-5944: The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4....

Security readout for executives and security teams

CVE-2017-5944 affects Request Tracker, a ticketing system. A logged-in user with certain RT privileges could potentially turn a saved search name into arbitrary code execution through the dashboard subscription feature. That makes affected internal helpdesk or operations systems a serious concern, even though the bundle does not provide a CVSS score. Exposure is most likely where Request Tracker versions are below the fixed releases and users can create or manage saved searches used by dashboard subscriptions. Public internet exposure raises risk, but the source bundle only establishes authenticated exploitation with certain privileges. Treat this as a high-priority remediation for any affected RT deployment, especially internet-accessible or broadly accessible internal instances. The business concern is compromise of a ticketing platform that may contain sensitive operational, customer, or security workflow data. Mitigation focus: Upgrade RT to 4.0.25, 4.2.14, 4.4.2, or later as applicable.; Apply Debian security update DSA-3882 where RT is installed from Debian packages.; Review Best Practical guidance for any version-specific upgrade or configuration notes..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.