CVE-2013-3737: Infoleak

Published Nov 16, 2014

Updated

The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.

Affected Software

13 affected components

bestpractical Request Tracker=4.0.0

bestpractical Request Tracker=4.0.1

bestpractical Request Tracker=4.0.2

bestpractical Request Tracker=4.0.3

bestpractical Request Tracker=4.0.4

bestpractical Request Tracker=4.0.5

bestpractical Request Tracker=4.0.6

bestpractical Request Tracker=4.0.7

bestpractical Request Tracker=4.0.8

bestpractical Request Tracker=4.0.9

bestpractical Request Tracker=4.0.10

bestpractical Request Tracker=4.0.11

bestpractical Request Tracker=4.0.12

Remediation

Patch Available

http://lists.bestpractical.com/pipermail/rt-announce/2013-June/000230.html

Event History

Nov 16, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3737?

CVE-2013-3737 has a medium severity level due to the potential for unauthorized session reuse.

How do I fix CVE-2013-3737?

To fix CVE-2013-3737, upgrade to Request Tracker version 4.0.13 or later.

What versions of Request Tracker are affected by CVE-2013-3737?

CVE-2013-3737 affects Request Tracker versions 4.0.0 through 4.0.12.

What type of attack does CVE-2013-3737 allow?

CVE-2013-3737 allows remote attackers to reuse unauthorized sessions and access user preferences.

What is the impact of CVE-2013-3737?

The impact of CVE-2013-3737 includes exposure of sensitive user session information and preferences.