PT-2013-4332 · Best Practical+1 · Request Tracker+1

Jenny Martin · Publicado 2013-08-23 · Atualizado 2017-09-03 · CVE-2013-3374

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Request Tracker (RT) versions 3.8.x through 3.8.16 Request Tracker (RT) versions 4.0.x through 4.0.12

Description The issue allows remote attackers to obtain sensitive information, such as user preferences and caches, via unknown vectors, related to a "limited session re-use" when using the Apache::Session::File session store.

Recommendations For versions 3.8.x through 3.8.16, update to version 3.8.17 or later. For versions 4.0.x through 4.0.12, update to version 4.0.13 or later.

Correção

Identificadores relacionados

CVE-2013-3374

DSA-2670-1

DSA-2671-1

MGASA-2017-0325

Produtos afetados

Apache::Session

Request Tracker

Referências · 21

• http://secunia.com/advisories/53522 · Aviso do Fabricante
• http://secunia.com/advisories/53505 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=16665 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-3374 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-3374 · Nota de Segurança
• http://debian.org/security/2012/dsa-2670 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html · Correção
• http://lists.bestpractical.com/pipermail/rt-announce/2015-August/000279.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-3374 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-3374 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3374 · Nota
• https://ubuntu.com/security/CVE-2013-3374 · Aviso do Fabricante