Best Practical Solutions Request Tracker contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when the program fails to perform certain redirect actions upon login, which will disclose login credentials to a physically present attacker who uses a web browser's back button after a logout.

Upgrade to version 3.8.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-1007 (see also: NVD)
• Secunia Advisory ID: 43438
• Related OSVDB ID: 71011
• VUPEN Advisory: ADV-2011-0475
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575
  http://issues.bestpractical.com/Ticket/Display.html?id=15804
  https://github.com/bestpractical/rt/commit/057552287159e801535e59b8fbd5bd98d1322069
  https://github.com/bestpractical/rt/commit/917c211820590950f7eb0521f7f43b31aeed44c4
• Other Advisory URL: http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html
  http://openwall.com/lists/oss-security/2011/02/22/12
  http://openwall.com/lists/oss-security/2011/02/22/16
  http://openwall.com/lists/oss-security/2011/02/22/6
  http://openwall.com/lists/oss-security/2011/02/23/22
  http://openwall.com/lists/oss-security/2011/02/24/7
  http://openwall.com/lists/oss-security/2011/02/24/8
  http://openwall.com/lists/oss-security/2011/02/24/9
• Mail List Post: http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

• Not Available