Vulnerability Details : CVE-2013-3373
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Products affected by CVE-2013-3373
- cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:rc5:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:rc4:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.11:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.13:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.11:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:preflight1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.14:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.13:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:preflight0:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.14:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.13:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.16:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.15:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-3373
0.67%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-3373
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2013-3373
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-3373
-
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
[rt-announce] RT 3.8.17 releasedPatch
-
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
[rt-announce] Security vulnerabilities in RTPatch
-
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
[rt-announce] RT 4.0.13 releasedPatch
Jump to