CVE-2013-3370 Missing authorization in n/a

Medium 6.8 Published 23 Aug 2013 Updated 17 Sep 2024

Remote attackers can access private callback components in Request Tracker due to improper access restrictions, potentially reading or modifying data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-3370?

CVE-2013-3370 is a medium-severity missing authorization vulnerability in n/a, published on 23 Aug 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.

Weakness: CWE-264

Which versions are affected by CVE-2013-3370?

It affects 1 product.

Products include Bestpractical Rt.

How do I fix CVE-2013-3370?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-3370 being exploited?

There is no known exploitation of CVE-2013-3370 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-3370, GHSA-7chq-pmg6-6mv3.