CVE-2012-4732 Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authen...
MediumCVSS 6.8
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.7-2 | 4.0.7-2 |
| bestpractical rt | = 3.8.12 | No fix listed |
| bestpractical rt | = 3.8.13 | No fix listed |
| bestpractical rt | = 3.8.13-rc1 | No fix listed |
| bestpractical rt | = 3.8.13-rc2 | No fix listed |
| bestpractical rt | = 3.8.14 | No fix listed |
| bestpractical rt | = 3.8.14-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
References
- Debian Security Tracker CVE-2012-4732 vendor-advisory
- [rt-announce] 20121025 Security vulnerabilities in RT mailing-list patch vendor-advisory
- 86714 vdb-entry