CVE-2013-3373 CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi...
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.12-2 | 4.0.12-2 |
| bestpractical rt | = 4.0.0 | No fix listed |
| bestpractical rt | = 4.0.0-rc1 | No fix listed |
| bestpractical rt | = 4.0.0-rc2 | No fix listed |
| bestpractical rt | = 4.0.0-rc3 | No fix listed |
| bestpractical rt | = 4.0.0-rc4 | No fix listed |
| bestpractical rt | = 4.0.0-rc5 | No fix listed |
| bestpractical rt | = 4.0.0-rc6 | No fix listed |
| bestpractical rt | = 4.0.0-rc7 | No fix listed |
| bestpractical rt | = 4.0.0-rc8 | No fix listed |
| bestpractical rt | = 4.0.1 | No fix listed |
| bestpractical rt | = 4.0.1-rc1 | No fix listed |
| bestpractical rt | = 4.0.1-rc2 | No fix listed |
| bestpractical rt | = 4.0.2 | No fix listed |
| bestpractical rt | = 4.0.2-rc1 | No fix listed |
| bestpractical rt | = 4.0.2-rc2 | No fix listed |
| bestpractical rt | = 4.0.3 | No fix listed |
| bestpractical rt | = 4.0.3-rc1 | No fix listed |
| bestpractical rt | = 4.0.3-rc2 | No fix listed |
| bestpractical rt | = 4.0.4 | No fix listed |
| bestpractical rt | = 4.0.5 | No fix listed |
| bestpractical rt | = 4.0.5-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
Show 53 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical rt | = 4.0.8 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
| bestpractical rt | = 4.0.9 | No fix listed |
| bestpractical rt | = 4.0.10 | No fix listed |
| bestpractical rt | = 4.0.11 | No fix listed |
| bestpractical rt | = 4.0.12 | No fix listed |
| bestpractical rt | = 3.8.0 | No fix listed |
| bestpractical rt | = 3.8.0-preflight1 | No fix listed |
| bestpractical rt | = 3.8.0-rc1 | No fix listed |
| bestpractical rt | = 3.8.0-rc2 | No fix listed |
| bestpractical rt | = 3.8.0-rc3 | No fix listed |
| bestpractical rt | = 3.8.1 | No fix listed |
| bestpractical rt | = 3.8.1-preflight0 | No fix listed |
| bestpractical rt | = 3.8.1-rc1 | No fix listed |
| bestpractical rt | = 3.8.1-rc2 | No fix listed |
| bestpractical rt | = 3.8.1-rc3 | No fix listed |
| bestpractical rt | = 3.8.1-rc4 | No fix listed |
| bestpractical rt | = 3.8.1-rc5 | No fix listed |
| bestpractical rt | = 3.8.2 | No fix listed |
| bestpractical rt | = 3.8.2-rc1 | No fix listed |
| bestpractical rt | = 3.8.2-rc2 | No fix listed |
| bestpractical rt | = 3.8.3 | No fix listed |
| bestpractical rt | = 3.8.3-rc1 | No fix listed |
| bestpractical rt | = 3.8.3-rc2 | No fix listed |
| bestpractical rt | = 3.8.4 | No fix listed |
| bestpractical rt | = 3.8.4-rc1 | No fix listed |
| bestpractical rt | = 3.8.5 | No fix listed |
| bestpractical rt | = 3.8.6 | No fix listed |
| bestpractical rt | = 3.8.6-rc1 | No fix listed |
| bestpractical rt | = 3.8.7 | No fix listed |
| bestpractical rt | = 3.8.7-rc1 | No fix listed |
| bestpractical rt | = 3.8.8 | No fix listed |
| bestpractical rt | = 3.8.8-rc2 | No fix listed |
| bestpractical rt | = 3.8.8-rc3 | No fix listed |
| bestpractical rt | = 3.8.8-rc4 | No fix listed |
| bestpractical rt | = 3.8.9 | No fix listed |
| bestpractical rt | = 3.8.9-rc1 | No fix listed |
| bestpractical rt | = 3.8.9-rc2 | No fix listed |
| bestpractical rt | = 3.8.9-rc3 | No fix listed |
| bestpractical rt | = 3.8.10 | No fix listed |
| bestpractical rt | = 3.8.10-rc1 | No fix listed |
| bestpractical rt | = 3.8.11 | No fix listed |
| bestpractical rt | = 3.8.11-rc1 | No fix listed |
| bestpractical rt | = 3.8.11-rc2 | No fix listed |
| bestpractical rt | = 3.8.12 | No fix listed |
| bestpractical rt | = 3.8.13 | No fix listed |
| bestpractical rt | = 3.8.13-rc1 | No fix listed |
| bestpractical rt | = 3.8.13-rc2 | No fix listed |
| bestpractical rt | = 3.8.14 | No fix listed |
| bestpractical rt | = 3.8.14-rc1 | No fix listed |
| bestpractical rt | = 3.8.15 | No fix listed |
| bestpractical rt | = 3.8.16 | No fix listed |
References
- Debian Security Tracker CVE-2013-3373 vendor-advisory
- [rt-announce] 20130522 Security vulnerabilities in RT mailing-list patch
- [rt-announce] 20130522 RT 4.0.13 released mailing-list patch
- [rt-announce] 20130522 RT 3.8.17 released mailing-list patch
- 53505 third-party-advisory vendor-advisory
- 53522 third-party-advisory vendor-advisory
- DSA-2670 vendor-advisory
- 93606 vdb-entry
- bugs.debian.org issue-tracking