Lucene search

MitreCVE-2012-4733

HistoryAug 23, 2013 - 4:55 p.m.

CVE-2012-4733

2013-08-2316:55:06

CWE-255

mitre

web.nvd.nist.gov

request tracker

rt 4.x

cve-2012-4733

deleteticket

custom lifecycle transition

permission

remote authenticated users

modifyticket

delete tickets

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

71.4%

JSON

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and “custom lifecycle transition” permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Affected configurations

Nvd

Node

bestpracticalrtMatch4.0.0

bestpracticalrtMatch4.0.0rc1

bestpracticalrtMatch4.0.0rc2

bestpracticalrtMatch4.0.0rc3

bestpracticalrtMatch4.0.0rc4

bestpracticalrtMatch4.0.0rc5

bestpracticalrtMatch4.0.0rc6

bestpracticalrtMatch4.0.0rc7

bestpracticalrtMatch4.0.0rc8

bestpracticalrtMatch4.0.1

bestpracticalrtMatch4.0.1rc1

bestpracticalrtMatch4.0.1rc2

bestpracticalrtMatch4.0.2

bestpracticalrtMatch4.0.2rc1

bestpracticalrtMatch4.0.2rc2

bestpracticalrtMatch4.0.3

bestpracticalrtMatch4.0.10

bestpracticalrtMatch4.0.11

bestpracticalrtMatch4.0.12

VendorProductVersionCPE
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*
bestpracticalrt4.0.0cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*
bestpracticalrt4.0.1cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:::::::*
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc1::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc2::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc3::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc4::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc5::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc6::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc7::::::
bestpractical	rt	4.0.0	cpe:2.3:a:bestpractical:rt:4.0.0:rc8::::::
bestpractical	rt	4.0.1	cpe:2.3:a:bestpractical:rt:4.0.1:::::::*