CVE-2013-3371 Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an atta...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.12-2 | 4.0.12-2 |
| bestpractical rt | = 3.8.0 | No fix listed |
| bestpractical rt | = 3.8.0-preflight1 | No fix listed |
| bestpractical rt | = 3.8.0-rc1 | No fix listed |
| bestpractical rt | = 3.8.0-rc2 | No fix listed |
| bestpractical rt | = 3.8.0-rc3 | No fix listed |
| bestpractical rt | = 3.8.1 | No fix listed |
| bestpractical rt | = 3.8.1-preflight0 | No fix listed |
| bestpractical rt | = 3.8.1-rc1 | No fix listed |
| bestpractical rt | = 3.8.1-rc2 | No fix listed |
| bestpractical rt | = 3.8.1-rc3 | No fix listed |
| bestpractical rt | = 3.8.1-rc4 | No fix listed |
| bestpractical rt | = 3.8.1-rc5 | No fix listed |
| bestpractical rt | = 3.8.2 | No fix listed |
| bestpractical rt | = 3.8.2-rc1 | No fix listed |
| bestpractical rt | = 3.8.2-rc2 | No fix listed |
| bestpractical rt | = 3.8.3 | No fix listed |
| bestpractical rt | = 3.8.3-rc1 | No fix listed |
| bestpractical rt | = 3.8.3-rc2 | No fix listed |
| bestpractical rt | = 3.8.4 | No fix listed |
| bestpractical rt | = 3.8.4-rc1 | No fix listed |
| bestpractical rt | = 3.8.5 | No fix listed |
| bestpractical rt | = 3.8.6 | No fix listed |
| bestpractical rt | = 3.8.6-rc1 | No fix listed |
| bestpractical rt | = 3.8.7 | No fix listed |
Show 53 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical rt | = 3.8.7-rc1 | No fix listed |
| bestpractical rt | = 3.8.8 | No fix listed |
| bestpractical rt | = 3.8.8-rc2 | No fix listed |
| bestpractical rt | = 3.8.8-rc3 | No fix listed |
| bestpractical rt | = 3.8.8-rc4 | No fix listed |
| bestpractical rt | = 3.8.9 | No fix listed |
| bestpractical rt | = 3.8.9-rc1 | No fix listed |
| bestpractical rt | = 3.8.9-rc2 | No fix listed |
| bestpractical rt | = 3.8.9-rc3 | No fix listed |
| bestpractical rt | = 3.8.10 | No fix listed |
| bestpractical rt | = 3.8.10-rc1 | No fix listed |
| bestpractical rt | = 3.8.11 | No fix listed |
| bestpractical rt | = 3.8.11-rc1 | No fix listed |
| bestpractical rt | = 3.8.11-rc2 | No fix listed |
| bestpractical rt | = 3.8.12 | No fix listed |
| bestpractical rt | = 3.8.13 | No fix listed |
| bestpractical rt | = 3.8.13-rc1 | No fix listed |
| bestpractical rt | = 3.8.13-rc2 | No fix listed |
| bestpractical rt | = 3.8.14 | No fix listed |
| bestpractical rt | = 3.8.14-rc1 | No fix listed |
| bestpractical rt | = 3.8.15 | No fix listed |
| bestpractical rt | = 3.8.16 | No fix listed |
| bestpractical rt | = 4.0.0 | No fix listed |
| bestpractical rt | = 4.0.0-rc1 | No fix listed |
| bestpractical rt | = 4.0.0-rc2 | No fix listed |
| bestpractical rt | = 4.0.0-rc3 | No fix listed |
| bestpractical rt | = 4.0.0-rc4 | No fix listed |
| bestpractical rt | = 4.0.0-rc5 | No fix listed |
| bestpractical rt | = 4.0.0-rc6 | No fix listed |
| bestpractical rt | = 4.0.0-rc7 | No fix listed |
| bestpractical rt | = 4.0.0-rc8 | No fix listed |
| bestpractical rt | = 4.0.1 | No fix listed |
| bestpractical rt | = 4.0.1-rc1 | No fix listed |
| bestpractical rt | = 4.0.1-rc2 | No fix listed |
| bestpractical rt | = 4.0.2 | No fix listed |
| bestpractical rt | = 4.0.2-rc1 | No fix listed |
| bestpractical rt | = 4.0.2-rc2 | No fix listed |
| bestpractical rt | = 4.0.3 | No fix listed |
| bestpractical rt | = 4.0.3-rc1 | No fix listed |
| bestpractical rt | = 4.0.3-rc2 | No fix listed |
| bestpractical rt | = 4.0.4 | No fix listed |
| bestpractical rt | = 4.0.5 | No fix listed |
| bestpractical rt | = 4.0.5-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
| bestpractical rt | = 4.0.8 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
| bestpractical rt | = 4.0.9 | No fix listed |
| bestpractical rt | = 4.0.10 | No fix listed |
| bestpractical rt | = 4.0.11 | No fix listed |
| bestpractical rt | = 4.0.12 | No fix listed |
References
- Debian Security Tracker CVE-2013-3371 vendor-advisory
- [rt-announce] 20130522 Security vulnerabilities in RT mailing-list patch
- [rt-announce] 20130522 RT 4.0.13 released mailing-list patch
- [rt-announce] 20130522 RT 3.8.17 released mailing-list patch
- 53505 third-party-advisory vendor-advisory
- 53522 third-party-advisory vendor-advisory
- DSA-2670 vendor-advisory
- 93608 vdb-entry
- bugs.debian.org issue-tracking