CVE-2012-4733

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlVendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch
http://secunia.com/advisories/53522Vendor Advisory
http://www.osvdb.org/93611
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlVendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch
http://secunia.com/advisories/53522Vendor Advisory
http://www.osvdb.org/93611

Timeline

Published: Aug 23, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-47345.0Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CVE-2012-47363.3The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction w CVE-2012-47376.0channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, As CVE-2012-47394.3Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbi CVE-2012-47404.3Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web s CVE-2012-47415.0The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assig CVE-2012-47427.5The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified CVE-2012-47437.5Multiple SQL injection vulnerabilities in ssearch.php in Siche search module 0.5 for Zeroboard allow remote attackers to execute arbitrary S CVE-2012-47444.3Cross-site scripting (XSS) vulnerability in ssearch.php in the Siche search module 0.5 for Zeroboard allows remote attackers to inject arbit CVE-2012-47454.3Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HT CVE-2012-47466.8Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the CVE-2012-47475.0Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially s