CVE-2018-18898 describes a denial-of-service vulnerability affecting the email-ingestion feature in Best Practical Request Tracker versions 4.1.13 through 4.4, as well as products from Canonical, Debian, and Fedora. This vulnerability carries a high CVSS score of 7.5 due to its network-based attack vector and low attack complexity, allowing remote attackers to cause a denial of service through an algorithmic complexity attack on email address parsing. While the EPSS score is low, indicating a low probability of exploitation in the wild, there is no known exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed on the CISA KEV catalog. Furthermore, there is no evidence of active exploitation or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.1.13, <= 4.4.0CPE matchmatch criteria | cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:* | ||
28CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* | ||
29CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.