CVE-2013-3370 Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a dir...
MediumCVSS 6.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.12-2 | 4.0.12-2 |
| bestpractical rt | = 4.0.0 | No fix listed |
| bestpractical rt | = 4.0.0-rc1 | No fix listed |
| bestpractical rt | = 4.0.0-rc2 | No fix listed |
| bestpractical rt | = 4.0.0-rc3 | No fix listed |
| bestpractical rt | = 4.0.0-rc4 | No fix listed |
| bestpractical rt | = 4.0.0-rc5 | No fix listed |
| bestpractical rt | = 4.0.0-rc6 | No fix listed |
| bestpractical rt | = 4.0.0-rc7 | No fix listed |
| bestpractical rt | = 4.0.0-rc8 | No fix listed |
| bestpractical rt | = 4.0.1 | No fix listed |
| bestpractical rt | = 4.0.1-rc1 | No fix listed |
| bestpractical rt | = 4.0.1-rc2 | No fix listed |
| bestpractical rt | = 4.0.2 | No fix listed |
| bestpractical rt | = 4.0.2-rc1 | No fix listed |
| bestpractical rt | = 4.0.2-rc2 | No fix listed |
| bestpractical rt | = 4.0.3 | No fix listed |
| bestpractical rt | = 4.0.3-rc1 | No fix listed |
| bestpractical rt | = 4.0.3-rc2 | No fix listed |
| bestpractical rt | = 4.0.4 | No fix listed |
| bestpractical rt | = 4.0.5 | No fix listed |
| bestpractical rt | = 4.0.5-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
Show 53 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical rt | = 4.0.8 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
| bestpractical rt | = 4.0.9 | No fix listed |
| bestpractical rt | = 4.0.10 | No fix listed |
| bestpractical rt | = 4.0.11 | No fix listed |
| bestpractical rt | = 4.0.12 | No fix listed |
| bestpractical rt | = 3.8.0 | No fix listed |
| bestpractical rt | = 3.8.0-preflight1 | No fix listed |
| bestpractical rt | = 3.8.0-rc1 | No fix listed |
| bestpractical rt | = 3.8.0-rc2 | No fix listed |
| bestpractical rt | = 3.8.0-rc3 | No fix listed |
| bestpractical rt | = 3.8.1 | No fix listed |
| bestpractical rt | = 3.8.1-preflight0 | No fix listed |
| bestpractical rt | = 3.8.1-rc1 | No fix listed |
| bestpractical rt | = 3.8.1-rc2 | No fix listed |
| bestpractical rt | = 3.8.1-rc3 | No fix listed |
| bestpractical rt | = 3.8.1-rc4 | No fix listed |
| bestpractical rt | = 3.8.1-rc5 | No fix listed |
| bestpractical rt | = 3.8.2 | No fix listed |
| bestpractical rt | = 3.8.2-rc1 | No fix listed |
| bestpractical rt | = 3.8.2-rc2 | No fix listed |
| bestpractical rt | = 3.8.3 | No fix listed |
| bestpractical rt | = 3.8.3-rc1 | No fix listed |
| bestpractical rt | = 3.8.3-rc2 | No fix listed |
| bestpractical rt | = 3.8.4 | No fix listed |
| bestpractical rt | = 3.8.4-rc1 | No fix listed |
| bestpractical rt | = 3.8.5 | No fix listed |
| bestpractical rt | = 3.8.6 | No fix listed |
| bestpractical rt | = 3.8.6-rc1 | No fix listed |
| bestpractical rt | = 3.8.7 | No fix listed |
| bestpractical rt | = 3.8.7-rc1 | No fix listed |
| bestpractical rt | = 3.8.8 | No fix listed |
| bestpractical rt | = 3.8.8-rc2 | No fix listed |
| bestpractical rt | = 3.8.8-rc3 | No fix listed |
| bestpractical rt | = 3.8.8-rc4 | No fix listed |
| bestpractical rt | = 3.8.9 | No fix listed |
| bestpractical rt | = 3.8.9-rc1 | No fix listed |
| bestpractical rt | = 3.8.9-rc2 | No fix listed |
| bestpractical rt | = 3.8.9-rc3 | No fix listed |
| bestpractical rt | = 3.8.10 | No fix listed |
| bestpractical rt | = 3.8.10-rc1 | No fix listed |
| bestpractical rt | = 3.8.11 | No fix listed |
| bestpractical rt | = 3.8.11-rc1 | No fix listed |
| bestpractical rt | = 3.8.11-rc2 | No fix listed |
| bestpractical rt | = 3.8.12 | No fix listed |
| bestpractical rt | = 3.8.13 | No fix listed |
| bestpractical rt | = 3.8.13-rc1 | No fix listed |
| bestpractical rt | = 3.8.13-rc2 | No fix listed |
| bestpractical rt | = 3.8.14 | No fix listed |
| bestpractical rt | = 3.8.14-rc1 | No fix listed |
| bestpractical rt | = 3.8.15 | No fix listed |
| bestpractical rt | = 3.8.16 | No fix listed |
References
- Debian Security Tracker CVE-2013-3370 vendor-advisory
- [rt-announce] 20130522 Security vulnerabilities in RT mailing-list patch
- [rt-announce] 20130522 RT 4.0.13 released mailing-list patch
- [rt-announce] 20130522 RT 3.8.17 released mailing-list patch
- 53505 third-party-advisory vendor-advisory
- 53522 third-party-advisory vendor-advisory
- DSA-2670 vendor-advisory
- 93609 vdb-entry
- bugs.debian.org issue-tracking