CVEvulnerability
CVE-2012-4734
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-11-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.
Affected configurations
• bestpractical rt 3.8.0
• bestpractical rt 3.8.1
• bestpractical rt 3.8.2
• bestpractical rt 3.8.3
• bestpractical rt 3.8.4
• bestpractical rt 3.8.5
• bestpractical rt 3.8.6
• bestpractical rt 3.8.7
• bestpractical rt 3.8.8
• bestpractical rt 3.8.9
• bestpractical rt 3.8.10
• bestpractical rt 3.8.11
• bestpractical rt 3.8.12
• bestpractical rt 3.8.13
• bestpractical rt 3.8.14
• bestpractical rt 4.0.0
• bestpractical rt 4.0.1
• bestpractical rt 4.0.2
• bestpractical rt 4.0.3
• bestpractical rt 4.0.4
• bestpractical rt 4.0.5
• bestpractical rt 4.0.6
• bestpractical rt 4.0.7
• bestpractical rt 4.0.8
Related
Weakness · not in database (1)
References
- http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html Vendor Advisory
- http://osvdb.org/86709 osvdb.org
- http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html Vendor Advisory
- http://osvdb.org/86709 osvdb.org