Lucene search

[email protected]CVE-2013-3737

HistoryNov 16, 2014 - 2:59 a.m.

CVE-2013-3737

2014-11-1602:59:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2013-3737

mobileui

rt-extension-mobileui

request tracker

apache::session::file

authentication

unauthorized sessions

remote attackers

7.7 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

71.0%

JSON

The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.

CPENameOperatorVersion
bestpractical:request_trackerbestpractical request trackereq4.0.0
bestpractical:request_trackerbestpractical request trackereq4.0.6
bestpractical:request_trackerbestpractical request trackereq4.0.7
bestpractical:request_trackerbestpractical request trackereq4.0.5
bestpractical:request_trackerbestpractical request trackereq4.0.1
bestpractical:request_trackerbestpractical request trackereq4.0.2
bestpractical:request_trackerbestpractical request trackereq4.0.10
bestpractical:request_trackerbestpractical request trackereq4.0.9
bestpractical:request_trackerbestpractical request trackereq4.0.4
bestpractical:request_trackerbestpractical request trackereq4.0.11

CPE	Name	Operator	Version
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.0
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.6
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.7
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.5
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.1
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.2
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.10
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.9
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.4
bestpractical:request_tracker	bestpractical request tracker	eq	4.0.11

Rows per page:

1-10 of 131

References

lists.bestpractical.com/pipermail/rt-announce/2013-June/000230.html

secunia.com/advisories/53799

www.osvdb.org/94280

7.7 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

71.0%

JSON

Related for CVE-2013-3737

cvelist1 prion1