Search criteria
114 vulnerabilities found for RT by bestpractical
CVE-2025-31500 (GCVE-0-2025-31500)
Vulnerability from cvelistv5 – Published: 2025-05-28 00:00 – Updated: 2025-05-28 17:59
VLAI?
Summary
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
5.0.0 , < 5.0.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T17:59:42.444191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:59:47.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:45:41.901Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-31500",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-28T00:00:00.000Z",
"dateUpdated": "2025-05-28T17:59:47.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-30087 (GCVE-0-2025-30087)
Vulnerability from cvelistv5 – Published: 2025-05-28 00:00 – Updated: 2025-11-03 19:46
VLAI?
Summary
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
4.4.0 , < 4.4.8
(semver)
Affected: 5.0.0 , < 5.0.8 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30087",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T18:00:11.113721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T18:00:16.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:46:45.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "4.4.8",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.8",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:53:01.345Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/4.4.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-30087",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-16T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:46:45.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31501 (GCVE-0-2025-31501)
Vulnerability from cvelistv5 – Published: 2025-05-28 00:00 – Updated: 2025-05-28 17:59
VLAI?
Summary
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
5.0.0 , < 5.0.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T17:59:24.546058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:59:29.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:48:25.633Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-31501",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-28T00:00:00.000Z",
"dateUpdated": "2025-05-28T17:59:29.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1474 (GCVE-0-2014-1474)
Vulnerability from cvelistv5 – Published: 2014-07-15 14:00 – Updated: 2024-08-06 09:42
VLAI?
Summary
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:42:35.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-15T11:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1474",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html",
"refsource": "CONFIRM",
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"name": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02",
"refsource": "CONFIRM",
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1474",
"datePublished": "2014-07-15T14:00:00",
"dateReserved": "2014-01-16T00:00:00",
"dateUpdated": "2024-08-06T09:42:35.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-5587 (GCVE-0-2013-5587)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-16 19:19
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:15:21.434Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5587",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5587",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-08-23T00:00:00Z",
"dateUpdated": "2024-09-16T19:19:35.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3370 (GCVE-0-2013-3370)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-17 00:00
VLAI?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3370",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3370",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T00:00:42.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3368 (GCVE-0-2013-3368)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-17 00:55
VLAI?
Summary
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3368",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3368",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T00:55:59.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3373 (GCVE-0-2013-3373)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-16 17:33
VLAI?
Summary
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.857Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3373",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3373",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-16T17:33:13.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3374 (GCVE-0-2013-3374)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-17 03:53
VLAI?
Summary
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.888Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93605"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a \"limited session re-use.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93605"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3374",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a \"limited session re-use.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93605"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3374",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T03:53:01.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3372 (GCVE-0-2013-3372)
Vulnerability from cvelistv5 – Published: 2013-08-23 16:00 – Updated: 2024-09-17 02:31
VLAI?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3372",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3372",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T02:31:37.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-31500 (GCVE-0-2025-31500)
Vulnerability from nvd – Published: 2025-05-28 00:00 – Updated: 2025-05-28 17:59
VLAI?
Summary
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
5.0.0 , < 5.0.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T17:59:42.444191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:59:47.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:45:41.901Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-31500",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-28T00:00:00.000Z",
"dateUpdated": "2025-05-28T17:59:47.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-30087 (GCVE-0-2025-30087)
Vulnerability from nvd – Published: 2025-05-28 00:00 – Updated: 2025-11-03 19:46
VLAI?
Summary
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
4.4.0 , < 4.4.8
(semver)
Affected: 5.0.0 , < 5.0.8 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30087",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T18:00:11.113721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T18:00:16.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:46:45.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "4.4.8",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.8",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:53:01.345Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/4.4.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-30087",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-16T00:00:00.000Z",
"dateUpdated": "2025-11-03T19:46:45.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31501 (GCVE-0-2025-31501)
Vulnerability from nvd – Published: 2025-05-28 00:00 – Updated: 2025-05-28 17:59
VLAI?
Summary
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestpractical | RT |
Affected:
5.0.0 , < 5.0.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T17:59:24.546058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:59:29.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT",
"vendor": "bestpractical",
"versions": [
{
"lessThan": "5.0.8",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.8",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:48:25.633Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://docs.bestpractical.com/release-notes/rt/index.html"
},
{
"url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-31501",
"datePublished": "2025-05-28T00:00:00.000Z",
"dateReserved": "2025-03-28T00:00:00.000Z",
"dateUpdated": "2025-05-28T17:59:29.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1474 (GCVE-0-2014-1474)
Vulnerability from nvd – Published: 2014-07-15 14:00 – Updated: 2024-08-06 09:42
VLAI?
Summary
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:42:35.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-15T11:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1474",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html",
"refsource": "CONFIRM",
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"name": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02",
"refsource": "CONFIRM",
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"name": "[rt-announce] 20140612 RT 4.2.5 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1474",
"datePublished": "2014-07-15T14:00:00",
"dateReserved": "2014-01-16T00:00:00",
"dateUpdated": "2024-08-06T09:42:35.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-5587 (GCVE-0-2013-5587)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-16 19:19
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:15:21.434Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5587",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5587",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-08-23T00:00:00Z",
"dateUpdated": "2024-09-16T19:19:35.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3370 (GCVE-0-2013-3370)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-17 00:00
VLAI?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3370",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "93609",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93609"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3370",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T00:00:42.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3368 (GCVE-0-2013-3368)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-17 00:55
VLAI?
Summary
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3368",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "93612",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93612"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3368",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T00:55:59.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3373 (GCVE-0-2013-3373)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-16 17:33
VLAI?
Summary
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.857Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3373",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93606",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93606"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3373",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-16T17:33:13.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3374 (GCVE-0-2013-3374)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-17 03:53
VLAI?
Summary
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.888Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93605"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a \"limited session re-use.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93605"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3374",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a \"limited session re-use.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
},
{
"name": "93605",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93605"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3374",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T03:53:01.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3372 (GCVE-0-2013-3372)
Vulnerability from nvd – Published: 2013-08-23 16:00 – Updated: 2024-09-17 02:31
VLAI?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:07:37.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53522"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-23T16:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53522"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3372",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[rt-announce] 20130522 RT 3.8.17 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"name": "[rt-announce] 20130522 Security vulnerabilities in RT",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"name": "[rt-announce] 20130522 RT 4.0.13 released",
"refsource": "MLIST",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"name": "93607",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/93607"
},
{
"name": "53505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53505"
},
{
"name": "DSA-2670",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"name": "53522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53522"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3372",
"datePublished": "2013-08-23T16:00:00Z",
"dateReserved": "2013-05-06T00:00:00Z",
"dateUpdated": "2024-09-17T02:31:37.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2014-1474
Vulnerability from fkie_nvd - Published: 2014-07-15 14:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestpractical | rt | 4.2.0 | |
| bestpractical | rt | 4.2.1 | |
| bestpractical | rt | 4.2.2 | |
| email\ | \ | address\ |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D219D49-924E-4B71-83B0-546AD854A826",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "831BDCD8-F8DF-4308-9451-CBD4137E41FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "64EDF9DF-6F3D-440D-AF17-D6E5CEAC9BEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:email\\:\\:address\\:\\:list_project:email\\:\\:address\\:\\:list:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ADE888A3-E320-4446-B0E7-0F80836B3D99",
"versionEndIncluding": "0.01",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address."
},
{
"lang": "es",
"value": "Vulnerabilidad en la complejidad algor\u00edtmica en Email::Address::List anterior a 0.02, utilizado en RT 4.2.0 hasta 4.2.2, permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de CPU) a trav\u00e9s de una cadena sin direcci\u00f3n."
}
],
"id": "CVE-2014-1474",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-07-15T14:55:08.747",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2014-June/000257.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://metacpan.org/changes/release/ALEXMV/Email-Address-List-0.02"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-189"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3369
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors."
},
{
"lang": "es",
"value": "Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a los usuarios remotos autenticados con los permisos para ver las p\u00e1ginas de administraci\u00f3n para ejecutar a su elecci\u00f3n los componentes privados a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-3369",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:07.203",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93610"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93610"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3372
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors."
},
{
"lang": "es",
"value": "Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a atacantes remotos inyectar varias cabeceras HTTP Content-Disposition y, posiblemente, realizar ataques de cross-site scripting (XSS) a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-3372",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-23T16:55:07.293",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93607"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-5587
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.3 | |
| bestpractical | rt | 4.0.3 | |
| bestpractical | rt | 4.0.3 | |
| bestpractical | rt | 4.0.4 | |
| bestpractical | rt | 4.0.5 | |
| bestpractical | rt | 4.0.5 | |
| bestpractical | rt | 4.0.6 | |
| bestpractical | rt | 4.0.7 | |
| bestpractical | rt | 4.0.7 | |
| bestpractical | rt | 4.0.8 | |
| bestpractical | rt | 4.0.8 | |
| bestpractical | rt | 4.0.8 | |
| bestpractical | rt | 4.0.9 | |
| bestpractical | rt | 4.0.10 | |
| bestpractical | rt | 4.0.11 | |
| bestpractical | rt | 4.0.12 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
},
{
"lang": "es",
"value": "Vulnerabilidad Cross-site scripting (XSS) en Request Tracker (RT) v4.x anterior a v4.0.13, cuando se configura MakeClicky, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s una URL en un ticket. NOTA: este problema se ha dividido desde CVE-2013-3371 debido a las diferentes versiones afectadas."
}
],
"id": "CVE-2013-5587",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-23T16:55:07.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3370
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request."
},
{
"lang": "es",
"value": "Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 no restringe adecuadamente el acceso a los componentes de devoluci\u00f3n de llamada privados, lo que permite a atacantes remotos tienen un impacto no especificado a trav\u00e9s de una petici\u00f3n directa."
}
],
"id": "CVE-2013-3370",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:07.233",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93609"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93609"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3371
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment."
},
{
"lang": "es",
"value": "Vulnerabilidad Cross-site scripting (XSS) en Request Tracker (RT) v3.8.3 hasta v3.8.16 y v4.0.x anterior a v4.0.13 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del nombre de archivo de datos adjuntos."
}
],
"id": "CVE-2013-3371",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-23T16:55:07.260",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93608"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93608"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3374
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a \"limited session re-use.\""
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13, cuando se utiliza el almacenamiento de sesiones Apache::Session::File, permite a atacantes remotos obtener informaci\u00f3n sensible (las preferencias del usuario y las memorias cach\u00e9) a trav\u00e9s de vectores desconocidos relacionados con una \"reutilizaci\u00f3n de sesi\u00f3n limitada.\""
}
],
"id": "CVE-2013-3374",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:07.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93605"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93605"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3368
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name."
},
{
"lang": "es",
"value": "bin/rt en Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a los usuarios locales sobreescribir archivos arbitrarios a trav\u00e9s de un ataque de enlaces simb\u00f3licos en un archivo temporal con nombre predecible."
}
],
"id": "CVE-2013-3368",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:07.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93612"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93612"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3373
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*",
"matchCriteriaId": "34A06E8A-1591-4ED9-AE0D-4A95E3327FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EA620414-F78C-49C2-AC29-7CCCCC15B4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A12FC95C-F9A7-4E47-AC07-F680D4436156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D6101EAE-CB0E-4AB2-BCDC-9B4354422940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*",
"matchCriteriaId": "54941FC4-7DD6-4F6D-AA14-296045D55C44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "46059518-DCCB-410A-B7FD-FAF5F9DF9498",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CB1FAAF6-4403-4A45-B0D8-F9E4752C0CBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "A6E90C9D-CCEF-47CE-BED1-16BF37927998",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "13410E37-9A6A-4A33-BB97-6B4D96AA11FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "02949074-A703-4F6E-BBA7-B79021A1377E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9C440174-183B-423B-8E85-37E78EB43A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CED5D54-C62B-4543-9C36-D76489EA3CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0B9A9DF7-8700-4CD4-9DAA-5368066F17A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "AC116B6E-F6A7-4885-B592-635EE06B6E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9635AFA4-24E6-4893-8B4B-57FE811A758D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4D117A-92C0-4884-A3E6-F6FCC8B89458",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AED14B5B-A9DE-46A4-8996-F6DC75B5DCD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D237F862-E8D5-4D82-9CDC-A8A84D2DE665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "84FB5217-7650-4BB2-A0AB-BAB6A362CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B306ECCE-8095-48E7-A523-05F6B2AF686E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BF6295-E0EF-44B8-A694-348EF39371BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6FBA787-90EE-4148-804C-F4F6021D5177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9035493E-C9BA-4DDE-914A-E14CB072E745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "19E636D2-525B-4B27-A9E1-16BC0088C8AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "546F1582-B85F-4D4F-840C-6257F1DE05E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F9040C7B-9080-4B57-885D-9275B9623E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B927C5E-EAC2-4032-905A-BBCE66693958",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D8DB6F17-FF2F-4DCA-A8D1-C3E0D42ACCAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*",
"matchCriteriaId": "32BE1C0B-D379-4A51-8188-B660730539AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DDD10111-15EC-4749-BC02-97979FFFA370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E768F1-80EA-4016-837E-9B92A3954F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82B26A8A-701E-4144-BE4A-E7C886C2E7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2C19BF7A-B957-422B-8B93-DB1B986979AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C35364B8-6BB7-439D-9450-08FB11639E76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A205895-B227-49C0-879A-72FB0BDA8A6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B5E26C51-9F68-4A2E-9B91-CD90C91E1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C4581C2F-8573-41DD-8730-864D66053BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*",
"matchCriteriaId": "5822BA44-EF00-43AD-80AF-5AF8719E0C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4DC9BA2D-948D-42DE-A0AF-35BE5BE5F941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*",
"matchCriteriaId": "AE10624B-CEC3-4851-8C40-04DEDB17A4A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*",
"matchCriteriaId": "4FE28E11-DE45-44AF-929A-A0F48D14FBE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n CRLF en Request Tracker (RT) v3.8.x anterior a v3.8.17 y v4.0.x anterior a v4.0.13 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de divisi\u00f3n de respuesta HTTP a trav\u00e9s de un encabezado MIME."
}
],
"id": "CVE-2013-3373",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:07.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93606"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93606"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-4733
Vulnerability from fkie_nvd - Published: 2013-08-23 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.0 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.1 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.2 | |
| bestpractical | rt | 4.0.3 | |
| bestpractical | rt | 4.0.10 | |
| bestpractical | rt | 4.0.11 | |
| bestpractical | rt | 4.0.12 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and \"custom lifecycle transition\" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors."
},
{
"lang": "es",
"value": "Request Tracker (RT) v4.x anterior a v4.0.13 no aplica adecuadamente el permiso DeleteTicket y \"la transici\u00f3n del ciclo de vida personalizado\", lo que permite a usuarios remotos autenticados con el permiso ModifyTicket suprimir entradas a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2012-4733",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-23T16:55:06.947",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/93611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/93611"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}