CVEvulnerability
CVE-2012-4733
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-08-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-255
Description
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.
Affected configurations
• bestpractical rt 4.0.0
• bestpractical rt 4.0.1
• bestpractical rt 4.0.2
• bestpractical rt 4.0.3
• bestpractical rt 4.0.10
• bestpractical rt 4.0.11
• bestpractical rt 4.0.12
Related
Weakness · not in database (1)
References
- http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html Vendor Advisory
- http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html Patch
- http://secunia.com/advisories/53522 Vendor Advisory
- http://www.osvdb.org/93611 www.osvdb.org
- http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html Vendor Advisory
- http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html Patch
- http://secunia.com/advisories/53522 Vendor Advisory
- http://www.osvdb.org/93611 www.osvdb.org