CVE-2012-4733 : Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicke

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Published 2013-08-23 16:55:07

Updated 2013-08-27 17:16:06

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2012-4733

Bestpractical » RT » Version: 4.0.0 Update RC4
cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC5
cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC3
cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC2
cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC1
cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC6
cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC7
cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0 Update RC8
cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.2
cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.3
cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.0
cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.1
cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.1 Update RC2
cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.2 Update RC1
cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.1 Update RC1
cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.2 Update RC2
cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.10
cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.12
cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*
Matching versions
Bestpractical » RT » Version: 4.0.11
cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-4733

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-4733

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2012-4733

CWE-255

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-4733

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html

[rt-announce] Security vulnerabilities in RT
Vendor Advisory

CVEs referencing this url
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html

[rt-announce] RT 4.0.13 released
Patch

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2012-4733

Products affected by CVE-2012-4733

Exploit prediction scoring system (EPSS) score for CVE-2012-4733

CVSS scores for CVE-2012-4733

CWE ids for CVE-2012-4733

References for CVE-2012-4733