Unscored severity · published Nov 17, 2009
CVE-2009-3892
Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
RT · Bestpractical
3.4.6; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3892
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/11/15/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/11/16/4
More from RT
9.1
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
8.8
CVE-2026-41075
RT: SQL injection via entry_aggregator parameter in JSON search
8.1
CVE-2026-41076
RT: LDAP authentication bypass via empty password
7.1
CVE-2026-41074
RT has broken CSRF protection for authenticated users
6.1
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart