CVE-2013-3374: Medium severity best practical solutions request tracker vulnerability

Published Aug 23, 2013

Updated

Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."

Affected Software

77 affected components

bestpractical RT=4.0.0

bestpractical RT=4.0.0-rc1

bestpractical RT=4.0.0-rc2

bestpractical RT=4.0.0-rc3

bestpractical RT=4.0.0-rc4

bestpractical RT=4.0.0-rc5

bestpractical RT=4.0.0-rc6

bestpractical RT=4.0.0-rc7

bestpractical RT=4.0.0-rc8

bestpractical RT=4.0.1

bestpractical RT=4.0.1-rc1

bestpractical RT=4.0.1-rc2

bestpractical RT=4.0.2

bestpractical RT=4.0.2-rc1

bestpractical RT=4.0.2-rc2

bestpractical RT=4.0.3

bestpractical RT=4.0.3-rc1

bestpractical RT=4.0.3-rc2

bestpractical RT=4.0.4

bestpractical RT=4.0.5

bestpractical RT=4.0.5-rc1

bestpractical RT=4.0.6

bestpractical RT=4.0.7

bestpractical RT=4.0.7-rc1

bestpractical RT=4.0.8

bestpractical RT=4.0.8-rc1

bestpractical RT=4.0.8-rc2

bestpractical RT=4.0.9

bestpractical RT=4.0.10

bestpractical RT=4.0.11

bestpractical RT=4.0.12

bestpractical RT=3.8.0

bestpractical RT=3.8.0-preflight1

bestpractical RT=3.8.0-rc1

bestpractical RT=3.8.0-rc2

bestpractical RT=3.8.0-rc3

bestpractical RT=3.8.1

bestpractical RT=3.8.1-preflight0

bestpractical RT=3.8.1-rc1

bestpractical RT=3.8.1-rc2

bestpractical RT=3.8.1-rc3

bestpractical RT=3.8.1-rc4

bestpractical RT=3.8.1-rc5

bestpractical RT=3.8.2

bestpractical RT=3.8.2-rc1

bestpractical RT=3.8.2-rc2

bestpractical RT=3.8.3

bestpractical RT=3.8.3-rc1

bestpractical RT=3.8.3-rc2

bestpractical RT=3.8.4

bestpractical RT=3.8.4-rc1

bestpractical RT=3.8.5

bestpractical RT=3.8.6

bestpractical RT=3.8.6-rc1

bestpractical RT=3.8.7

bestpractical RT=3.8.7-rc1

bestpractical RT=3.8.8

bestpractical RT=3.8.8-rc2

bestpractical RT=3.8.8-rc3

bestpractical RT=3.8.8-rc4

bestpractical RT=3.8.9

bestpractical RT=3.8.9-rc1

bestpractical RT=3.8.9-rc2

bestpractical RT=3.8.9-rc3

bestpractical RT=3.8.10

bestpractical RT=3.8.10-rc1

bestpractical RT=3.8.11

bestpractical RT=3.8.11-rc1

bestpractical RT=3.8.11-rc2

bestpractical RT=3.8.12

bestpractical RT=3.8.13

bestpractical RT=3.8.13-rc1

bestpractical RT=3.8.13-rc2

bestpractical RT=3.8.14

bestpractical RT=3.8.14-rc1

bestpractical RT=3.8.15

bestpractical RT=3.8.16

Remediation

Patch Available

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html

Patch Available

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html

Event History

Aug 23, 2013

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3374?

CVE-2013-3374 has a moderate severity level due to its impact on user privacy and data security.

How do I fix CVE-2013-3374?

To fix CVE-2013-3374, upgrade to Request Tracker version 3.8.17 or 4.0.13 or later.

What types of information can be exposed in CVE-2013-3374?

CVE-2013-3374 allows remote attackers to potentially access sensitive user information, such as preferences and caches.

Which versions of Request Tracker are affected by CVE-2013-3374?

CVE-2013-3374 affects Request Tracker versions 3.8.x before 3.8.17 and 4.0.x before 4.0.13.

Can CVE-2013-3374 be exploited remotely?

Yes, CVE-2013-3374 can be exploited by remote attackers, making it a significant risk.

CVE-2013-3374: Medium severity best practical solutions request tracker vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2013-3374?

How do I fix CVE-2013-3374?

What types of information can be exposed in CVE-2013-3374?

Which versions of Request Tracker are affected by CVE-2013-3374?

Can CVE-2013-3374 be exploited remotely?

Company

Resources

Contact