CVE-2012-4730

Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors.

Published Bycve@mitre.org

Published DateNov 11, 2012, 13:00

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE

References

http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE