PT-2012-5561 · Best Practical · Request Tracker

Matthew Astley · Published 2012-11-11 · Updated 2013-03-02 · CVE-2012-4732

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Request Tracker versions 3.8.12 through 3.8.14 Request Tracker versions 4.0.6 through 4.0.7

Description A cross-site request forgery issue allows remote attackers to hijack user authentication for specific requests, such as toggling ticket bookmarks.

Recommendations For versions 3.8.12 through 3.8.14, update to version 3.8.15 or later. For versions 4.0.6 through 4.0.7, update to version 4.0.8 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-4732

DSA-2567-1

Affected Products

Request Tracker

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-4732 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-4732 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4732 · Vendor Advisory
• http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4732 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4732 · Note
• http://osvdb.org/86714 · Note