| Vulnerability Name: | CVE-2012-4732 (CCN-79610) | ||||||||||||||||||||||||
| Assigned: | 2012-10-25 | ||||||||||||||||||||||||
| Published: | 2012-10-25 | ||||||||||||||||||||||||
| Updated: | 2013-03-02 | ||||||||||||||||||||||||
| Summary: | Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-352 | ||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||
| References: | Source: CCN Type: Best Practical Web site Best Practical Source: MITRE Type: CNA CVE-2012-4732 Source: CCN Type: rt-announce Security vulnerabilities in RT Source: MLIST Type: Patch, Vendor Advisory [rt-announce] 20121025 Security vulnerabilities in RT Source: OSVDB Type: UNKNOWN 86714 Source: CCN Type: SA51065 RT Multiple Vulnerabilities Source: DEBIAN Type: DSA-2567 request-tracker3.8 -- several vulnerabilities Source: CCN Type: OSVDB ID: 86714 RT Ticket Bookmark Toggling CSRF Source: XF Type: UNKNOWN rt-unspecified-csrf(79610) | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||