CVE-2009-4151

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT...

5.8 MediumFix available

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT server," a related issue to CVE-2009-3585.

Exploit likelihood

1.84%Down 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2009-4151
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4151
Updated: 2026-11-02

EUVDEUVD-2009-4121 No score

Record: EUVD-2009-4121
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pcr4-mc8q-h9h5 No score

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT...

Record: GHSA-pcr4-mc8q-h9h5
Weakness: CWE-287
Updated: 2026-11-02

Affected products

bestpractical rt

Affected packages

Affected packages
Package	Affected	Fixed
`request-tracker3.6` Debian:4.0	before 3.6.1-4+etch1, plus listed versions 3.6.1-4	3.6.1-4+etch1
`request-tracker3.4` Debian:4.0	before 3.4.5-2+etch1, plus listed versions 3.4.5-2	3.4.5-2+etch1
`request-tracker3.6` Debian:5.0	before 3.6.7-5+lenny3, plus listed versions 3.6.7-53.6.7-5+lenny13.6.7-5+lenny2	3.6.7-5+lenny3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4151 is a medium vulnerability (CVSS 5.8) in Bestpractical Rt, published December 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in request-tracker3.6 3.6.1-4+etch1.

References

Show 12 moreShow less