Vulnerability CVE-2012-4733
Published: 2013-08-23

Description:
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Type:

CWE-255

 (Credentials Management)

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6/10
6.4/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Bestpractical -> Request tracker 
Bestpractical -> RT 

 References:
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
http://www.osvdb.org/93611
http://secunia.com/advisories/53522
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
Copyright 2024, cxsecurity.com

 

Back to Top