CVE-2013-3373: Code Injection
Published Aug 23, 2013
·Updated
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
Affected Software
77 affected components
bestpractical RT=4.0.0
bestpractical RT=4.0.0-rc1
bestpractical RT=4.0.0-rc2
bestpractical RT=4.0.0-rc3
bestpractical RT=4.0.0-rc4
bestpractical RT=4.0.0-rc5
bestpractical RT=4.0.0-rc6
bestpractical RT=4.0.0-rc7
bestpractical RT=4.0.0-rc8
bestpractical RT=4.0.1
bestpractical RT=4.0.1-rc1
bestpractical RT=4.0.1-rc2
bestpractical RT=4.0.2
bestpractical RT=4.0.2-rc1
bestpractical RT=4.0.2-rc2
bestpractical RT=4.0.3
bestpractical RT=4.0.3-rc1
bestpractical RT=4.0.3-rc2
bestpractical RT=4.0.4
bestpractical RT=4.0.5
bestpractical RT=4.0.5-rc1
bestpractical RT=4.0.6
bestpractical RT=4.0.7
bestpractical RT=4.0.7-rc1
bestpractical RT=4.0.8
bestpractical RT=4.0.8-rc1
bestpractical RT=4.0.8-rc2
bestpractical RT=4.0.9
bestpractical RT=4.0.10
bestpractical RT=4.0.11
bestpractical RT=4.0.12
bestpractical RT=3.8.0
bestpractical RT=3.8.0-preflight1
bestpractical RT=3.8.0-rc1
bestpractical RT=3.8.0-rc2
bestpractical RT=3.8.0-rc3
bestpractical RT=3.8.1
bestpractical RT=3.8.1-preflight0
bestpractical RT=3.8.1-rc1
bestpractical RT=3.8.1-rc2
bestpractical RT=3.8.1-rc3
bestpractical RT=3.8.1-rc4
bestpractical RT=3.8.1-rc5
bestpractical RT=3.8.2
bestpractical RT=3.8.2-rc1
bestpractical RT=3.8.2-rc2
bestpractical RT=3.8.3
bestpractical RT=3.8.3-rc1
bestpractical RT=3.8.3-rc2
bestpractical RT=3.8.4
bestpractical RT=3.8.4-rc1
bestpractical RT=3.8.5
bestpractical RT=3.8.6
bestpractical RT=3.8.6-rc1
bestpractical RT=3.8.7
bestpractical RT=3.8.7-rc1
bestpractical RT=3.8.8
bestpractical RT=3.8.8-rc2
bestpractical RT=3.8.8-rc3
bestpractical RT=3.8.8-rc4
bestpractical RT=3.8.9
bestpractical RT=3.8.9-rc1
bestpractical RT=3.8.9-rc2
bestpractical RT=3.8.9-rc3
bestpractical RT=3.8.10
bestpractical RT=3.8.10-rc1
bestpractical RT=3.8.11
bestpractical RT=3.8.11-rc1
bestpractical RT=3.8.11-rc2
bestpractical RT=3.8.12
bestpractical RT=3.8.13
bestpractical RT=3.8.13-rc1
bestpractical RT=3.8.13-rc2
bestpractical RT=3.8.14
bestpractical RT=3.8.14-rc1
bestpractical RT=3.8.15
bestpractical RT=3.8.16
Remediation
Event History
Aug 23, 2013
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3373?
CVE-2013-3373 has a medium severity rating, allowing remote attackers to inject arbitrary HTTP headers.
2
How do I fix CVE-2013-3373?
To fix CVE-2013-3373, upgrade Request Tracker to version 3.8.17 or 4.0.13 or later.
3
What software versions are affected by CVE-2013-3373?
CVE-2013-3373 affects Request Tracker versions 3.8.x before 3.8.17 and 4.0.x before 4.0.13.
4
What types of attacks can be performed using CVE-2013-3373?
CVE-2013-3373 can be exploited for HTTP response splitting attacks due to CRLF injection.
5
Who should be concerned about CVE-2013-3373?
Administrators of Request Tracker versions prior to the fixed releases should be concerned about CVE-2013-3373.