CVE-2013-3369

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.htmlPatch, Vendor Advisory
http://secunia.com/advisories/53505Vendor Advisory
http://secunia.com/advisories/53522Vendor Advisory
http://www.debian.org/security/2012/dsa-2670
http://www.osvdb.org/93610
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.htmlPatch, Vendor Advisory
http://secunia.com/advisories/53505Vendor Advisory
http://secunia.com/advisories/53522Vendor Advisory
http://www.debian.org/security/2012/dsa-2670
http://www.osvdb.org/93610

Timeline

Published: Aug 23, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-33706.8Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which all CVE-2013-33714.3Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inj CVE-2013-33724.3Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers CVE-2013-33735.0CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary CVE-2013-33744.3Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session CVE-2013-33754.3Cross-site scripting (XSS) vulnerability in the portal page in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers CVE-2013-33764.3Open redirect vulnerability in the help page in Cisco Video Surveillance Operations Manager allows remote attackers to redirect users to arb CVE-2013-33777.8Cisco TelePresence TC Software before 5.1.7 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (device reload)CVE-2013-33787.8Cisco TelePresence TC Software before 6.1 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (temporary device CVE-2013-33798.3The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allo CVE-2013-33804.0The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the rep CVE-2013-33815.0Cisco Hosted Collaboration Mediation allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP pac