CVE-2013-3736: XSS
Published May 5, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file.
Affected Software
14 affected components
bestpractical Request Tracker=4.0.0
bestpractical Request Tracker=4.0.1
bestpractical Request Tracker=4.0.2
bestpractical Request Tracker=4.0.3
bestpractical Request Tracker=4.0.4
bestpractical Request Tracker=4.0.5
bestpractical Request Tracker=4.0.6
bestpractical Request Tracker=4.0.7
bestpractical Request Tracker=4.0.8
bestpractical Request Tracker=4.0.9
bestpractical Request Tracker=4.0.10
bestpractical Request Tracker=4.0.11
bestpractical Request Tracker=4.0.12
bestpractical Rt-extension-mobileui<=1.02
Remediation
Event History
May 5, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:06 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-3736?
CVE-2013-3736 is identified as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2013-3736?
To fix CVE-2013-3736, upgrade to MobileUI extension version 1.04 or later.
3
Which versions of Request Tracker are affected by CVE-2013-3736?
CVE-2013-3736 affects Request Tracker versions 4.0.0 through 4.0.12.
4
Can CVE-2013-3736 be exploited remotely?
Yes, CVE-2013-3736 can be exploited remotely by attackers leveraging the file attach feature.
5
What type of attack is associated with CVE-2013-3736?
CVE-2013-3736 is associated with cross-site scripting (XSS) attacks.