CVEvulnerability
CVE-2012-6581
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-07-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.
Affected configurations
• bestpractical request tracker 3.8.3
• bestpractical request tracker 3.8.4
• bestpractical request tracker 3.8.7
• bestpractical request tracker 3.8.9
• bestpractical request tracker 3.8.10
• bestpractical request tracker 3.8.11
• bestpractical request tracker 3.8.12
• bestpractical request tracker 3.8.13
• bestpractical request tracker 3.8.14
• bestpractical request tracker 4.0.0
• bestpractical request tracker 4.0.1
• bestpractical request tracker 4.0.2
• bestpractical request tracker 4.0.3
• bestpractical request tracker 4.0.4
• bestpractical request tracker 4.0.5
• bestpractical request tracker 4.0.6
• bestpractical request tracker 4.0.7
Related
Weakness · not in database (1)
References
- http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html Patch, Vendor Advisory
- http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html Patch, Vendor Advisory