CVE-2013-3368 — Link Following in Request-tracker4

CWE-59 — Link Following4 documents4 sources
Severity
3.3LOWNVD
EPSS
0.0%
top 87.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Request-tracker4Bestpractical RT
Timeline
PublishedAug 23
Latest updateMay 17

Description

bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.

CVSS vector

AV:L/AC:M/C:N/I:P/A:PExploitability: 3.4 | Impact: 4.9

Affected Packages2 packages

▶debiandebian/request-tracker4< request-tracker4 4.0.12-2 (bookworm)
▶NVDbestpractical/rt30 versions+29

Patches

Patch: lists.bestpractical.com ↗Patch: lists.bestpractical.com ↗Patch: lists.bestpractical.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wq7m-77gq-ff44: bin/rt in Request Tracker (RT) 3↗2022-05-17
▶
OSV
CVE-2013-3368: bin/rt in Request Tracker (RT) 3↗2013-08-23
▶

📋Vendor Advisories

1
Debian
CVE-2013-3368: request-tracker4 - bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allow...↗2013
▶
CVE-2013-3368 — Link Following in Request-tracker4 | cvebase