CVE-2012-4733

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Published Bycve@mitre.org

Published DateAug 23, 2013, 16:55

Weakness Type (CWE):CWE-255

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
http://secunia.com/advisories/53522
http://www.osvdb.org/93611

Weakness Type (CWE):CWE-255

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL