Summary
| Detail | |||
|---|---|---|---|
| Vendor | Bestpractical | First view | 2012-08-15 |
| Product | Rt | Last view | 2013-08-23 |
| Version | 3.8.13 | Type | Application |
| Update | rc1 | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:bestpractical:rt | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 4.3 | 2013-08-23 | CVE-2013-3374 | Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use." |
| 5 | 2013-08-23 | CVE-2013-3373 | CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header. |
| 4.3 | 2013-08-23 | CVE-2013-3372 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| 4.3 | 2013-08-23 | CVE-2013-3371 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment. |
| 6.8 | 2013-08-23 | CVE-2013-3370 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request. |
| 6 | 2013-08-23 | CVE-2013-3369 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors. |
| 3.3 | 2013-08-23 | CVE-2013-3368 | bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name. |
| 5 | 2012-11-11 | CVE-2012-4884 | Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client. |
| 5 | 2012-11-11 | CVE-2012-4734 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link. |
| 6.8 | 2012-11-11 | CVE-2012-4732 | Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks. |
| 3.5 | 2012-11-11 | CVE-2012-4730 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors. |
| 4.3 | 2012-08-15 | CVE-2012-2769 | Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 30% (3) | CWE-264 | Permissions, Privileges, and Access Controls |
| 30% (3) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 20% (2) | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| 10% (1) | CWE-352 | Cross-Site Request Forgery (CSRF) |
| 10% (1) | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OpenVAS Exploits
| id | Description |
|---|---|
| 2012-11-26 | Name : FreeBSD Ports: rt40 File : nvt/freebsd_rt400.nasl |
| 2012-11-09 | Name : Fedora Update for rt3 FEDORA-2012-17174 File : nvt/gb_fedora_2012_17174_rt3_fc17.nasl |
| 2012-11-09 | Name : Fedora Update for rt3 FEDORA-2012-17218 File : nvt/gb_fedora_2012_17218_rt3_fc16.nasl |
| 2012-10-29 | Name : Debian Security Advisory DSA 2567-1 (request-tracker3.8) File : nvt/deb_2567_1.nasl |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2013-07-22 | Name: The remote web server is running a Perl application that is affected by multi... File: rt_4013.nasl - Type: ACT_GATHER_INFO |
| 2013-05-24 | Name: The remote FreeBSD host is missing one or more security-related updates. File: freebsd_pkg_3a429192c36a11e297a96805ca0b3d42.nasl - Type: ACT_GATHER_INFO |
| 2013-05-23 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-2670.nasl - Type: ACT_GATHER_INFO |
| 2013-05-23 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-2671.nasl - Type: ACT_GATHER_INFO |
| 2012-11-27 | Name: The remote web server is running a Perl application that is affected by multi... File: rt_3_8_15_or_4_0_8.nasl - Type: ACT_GATHER_INFO |
| 2012-11-08 | Name: The remote Fedora host is missing a security update. File: fedora_2012-17143.nasl - Type: ACT_GATHER_INFO |
| 2012-11-08 | Name: The remote Fedora host is missing a security update. File: fedora_2012-17174.nasl - Type: ACT_GATHER_INFO |
| 2012-11-08 | Name: The remote Fedora host is missing a security update. File: fedora_2012-17218.nasl - Type: ACT_GATHER_INFO |
| 2012-11-02 | Name: The remote FreeBSD host is missing one or more security-related updates. File: freebsd_pkg_4b738d54242711e29817c8600054b392.nasl - Type: ACT_GATHER_INFO |
| 2012-10-29 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-2567.nasl - Type: ACT_GATHER_INFO |
