CVE-2013-5587 Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket....
LowCVSS 2.6
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.12-2 | 4.0.12-2 |
| bestpractical rt | = 4.0.0 | No fix listed |
| bestpractical rt | = 4.0.0-rc1 | No fix listed |
| bestpractical rt | = 4.0.0-rc2 | No fix listed |
| bestpractical rt | = 4.0.0-rc3 | No fix listed |
| bestpractical rt | = 4.0.0-rc4 | No fix listed |
| bestpractical rt | = 4.0.0-rc5 | No fix listed |
| bestpractical rt | = 4.0.0-rc6 | No fix listed |
| bestpractical rt | = 4.0.0-rc7 | No fix listed |
| bestpractical rt | = 4.0.0-rc8 | No fix listed |
| bestpractical rt | = 4.0.1 | No fix listed |
| bestpractical rt | = 4.0.1-rc1 | No fix listed |
| bestpractical rt | = 4.0.1-rc2 | No fix listed |
| bestpractical rt | = 4.0.2 | No fix listed |
| bestpractical rt | = 4.0.2-rc1 | No fix listed |
| bestpractical rt | = 4.0.2-rc2 | No fix listed |
| bestpractical rt | = 4.0.3 | No fix listed |
| bestpractical rt | = 4.0.3-rc1 | No fix listed |
| bestpractical rt | = 4.0.3-rc2 | No fix listed |
| bestpractical rt | = 4.0.4 | No fix listed |
| bestpractical rt | = 4.0.5 | No fix listed |
| bestpractical rt | = 4.0.5-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical rt | = 4.0.8 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
| bestpractical rt | = 4.0.9 | No fix listed |
| bestpractical rt | = 4.0.10 | No fix listed |
| bestpractical rt | = 4.0.11 | No fix listed |
| bestpractical rt | = 4.0.12 | No fix listed |
References
- Debian Security Tracker CVE-2013-5587 vendor-advisory
- [rt-announce] 20130522 Security vulnerabilities in RT mailing-list patch
- [rt-announce] 20130522 RT 4.0.13 released mailing-list patch
- [rt-announce] 20130522 RT 3.8.17 released mailing-list patch
- 53505 third-party-advisory
- 53522 third-party-advisory vendor-advisory
- DSA-2670 vendor-advisory
- bugs.debian.org issue-tracking