CVE-2013-3370

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.

Weaknesses (CWE)

CWE-264

Affected Products (77)

bestpractical · rtvulnerable

...and 27 more

References (14)

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html

Patch

http://secunia.com/advisories/53505

Vendor Advisory

http://secunia.com/advisories/53522

Vendor Advisory

http://www.debian.org/security/2012/dsa-2670

http://www.osvdb.org/93609

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html

Patch

http://secunia.com/advisories/53505

Vendor Advisory

http://secunia.com/advisories/53522

Vendor Advisory

http://www.debian.org/security/2012/dsa-2670

http://www.osvdb.org/93609