CVE-2012-4734: CSRF

Published Nov 11, 2012

Updated

Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.

Affected Software

67 affected components

bestpractical RT=3.8.0

bestpractical RT=3.8.0-preflight1

bestpractical RT=3.8.0-rc1

bestpractical RT=3.8.0-rc2

bestpractical RT=3.8.0-rc3

bestpractical RT=3.8.1

bestpractical RT=3.8.1-preflight0

bestpractical RT=3.8.1-rc1

bestpractical RT=3.8.1-rc2

bestpractical RT=3.8.1-rc3

bestpractical RT=3.8.1-rc4

bestpractical RT=3.8.1-rc5

bestpractical RT=3.8.2

bestpractical RT=3.8.2-rc1

bestpractical RT=3.8.2-rc2

bestpractical RT=3.8.3

bestpractical RT=3.8.3-rc1

bestpractical RT=3.8.3-rc2

bestpractical RT=3.8.4

bestpractical RT=3.8.4-rc1

bestpractical RT=3.8.5

bestpractical RT=3.8.6

bestpractical RT=3.8.6-rc1

bestpractical RT=3.8.7

bestpractical RT=3.8.7-rc1

bestpractical RT=3.8.8

bestpractical RT=3.8.8-rc2

bestpractical RT=3.8.8-rc3

bestpractical RT=3.8.8-rc4

bestpractical RT=3.8.9

bestpractical RT=3.8.9-rc1

bestpractical RT=3.8.9-rc2

bestpractical RT=3.8.9-rc3

bestpractical RT=3.8.10

bestpractical RT=3.8.10-rc1

bestpractical RT=3.8.11

bestpractical RT=3.8.11-rc1

bestpractical RT=3.8.11-rc2

bestpractical RT=3.8.12

bestpractical RT=3.8.13-rc1

bestpractical RT=3.8.13-rc2

bestpractical RT=3.8.14-rc1

bestpractical RT=4.0.0

bestpractical RT=4.0.0-rc1

bestpractical RT=4.0.0-rc2

bestpractical RT=4.0.0-rc3

bestpractical RT=4.0.0-rc4

bestpractical RT=4.0.0-rc5

bestpractical RT=4.0.0-rc6

bestpractical RT=4.0.0-rc7

bestpractical RT=4.0.0-rc8

bestpractical RT=4.0.1

bestpractical RT=4.0.1-rc1

bestpractical RT=4.0.1-rc2

bestpractical RT=4.0.2

bestpractical RT=4.0.2-rc1

bestpractical RT=4.0.2-rc2

bestpractical RT=4.0.3

bestpractical RT=4.0.3-rc1

bestpractical RT=4.0.3-rc2

bestpractical RT=4.0.4

bestpractical RT=4.0.5

bestpractical RT=4.0.5-rc1

bestpractical RT=4.0.6

bestpractical RT=4.0.7-rc1

bestpractical RT=4.0.8-rc1

bestpractical RT=4.0.8-rc2

Event History

Nov 11, 2012

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4734?

CVE-2012-4734 has a moderate severity rating due to its potential for exploitation in bypassing CSRF protections.

How do I fix CVE-2012-4734?

To fix CVE-2012-4734, upgrade to Request Tracker version 3.8.15 or later for the 3.8.x series or 4.0.8 or later for the 4.0.x series.

What versions of Request Tracker are affected by CVE-2012-4734?

CVE-2012-4734 affects Request Tracker versions 3.8.0 through 3.8.14 and 4.0.0 through 4.0.7.

What attack is described by CVE-2012-4734?

CVE-2012-4734 describes a "confused deputy" attack that allows an attacker to bypass CSRF warning protections.

Is there a workaround for CVE-2012-4734?

There is no official workaround for CVE-2012-4734; the recommended action is to upgrade to a secure version.