Secunia

A vulnerability has been reported in RT, which can be exploited by malicious people to conduct cross site scripting attacks against users on the system.

The vulnerability is caused due to a lack of input validation in message bodies. This can be exploited by inserting malicious script code in an email. When the email is viewed by a user in the web interface, the script code will be executed in the user's browser session.

Successful exploitation can result in disclosure of various information (eg. cookie-based authentication information) associated with the site running RT or inclusion of malicious content, which the user thinks is part of the real website.

Solution
Users are advised to upgrade to RT 2.0.15 or RT 3.0.
Further details available in Customer Area

Provided and/or discovered by
Troy Davis and the Semaphore Corporation.

Deep Links
Links available in Customer Area