PT-2012-1021 · Best Practical Solutions · Rt+1

Alex Vandiver · Published 2012-08-15 · Updated 2017-08-29 · CVE-2012-2768

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT RTFM extension versions 2.0.4 through 2.4.3 rtfm package (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the topic administration page of the RTFM extension, allowing remote attackers to inject arbitrary web script or HTML. This could lead to a breach of protected information integrity. The exploitation of these vulnerabilities can be done remotely.

Recommendations For RTFM extension versions 2.0.4 through 2.4.3, consider disabling access to the topic administration page until a patch is available. As a temporary workaround, restrict the use of the RTFM extension to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-01313

CVE-2012-2768

DSA-2535-1

Affected Products

Rt

Rtfm

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2768 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2768 · Vendor Advisory
• http://secunia.com/advisories/50024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2768 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2768 · Security Note
• https://bdu.fstec.ru/vul/2015-01313 · Security Note
• http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2768 · Security Note
• http://secunia.com/advisories/50440 · Note
• http://securityfocus.com/bid/54689 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77212 · Note
• http://debian.org/security/dsa-2535 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2768 · Note