fkie_cve-2013-5587
Vulnerability from fkie_nvd
Published
2013-08-23 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
References
cve@mitre.orghttp://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlPatch
cve@mitre.orghttp://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch
cve@mitre.orghttp://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.htmlPatch
cve@mitre.orghttp://secunia.com/advisories/53505
cve@mitre.orghttp://secunia.com/advisories/53522Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2012/dsa-2670
af854a3a-2127-422b-91ae-364da2661108http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/53505
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/53522Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2012/dsa-2670
Impacted products
Vendor Product Version
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.0
bestpractical rt 4.0.1
bestpractical rt 4.0.1
bestpractical rt 4.0.1
bestpractical rt 4.0.2
bestpractical rt 4.0.2
bestpractical rt 4.0.2
bestpractical rt 4.0.3
bestpractical rt 4.0.3
bestpractical rt 4.0.3
bestpractical rt 4.0.4
bestpractical rt 4.0.5
bestpractical rt 4.0.5
bestpractical rt 4.0.6
bestpractical rt 4.0.7
bestpractical rt 4.0.7
bestpractical rt 4.0.8
bestpractical rt 4.0.8
bestpractical rt 4.0.8
bestpractical rt 4.0.9
bestpractical rt 4.0.10
bestpractical rt 4.0.11
bestpractical rt 4.0.12


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F84987A7-103B-4473-9D4F-9F28880F6D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "9E220C7C-D32C-4ED1-A056-074576B7B504",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "57A903C6-3C9F-47A0-92F7-D5272B2622AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "67EBD0AE-1A91-4690-8A07-0FB7342768FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A1217A3C-2302-4E3B-BF35-4B16271A6FF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "A72E5649-26E5-47DE-9CB4-019FEC8AF13E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "51E06E3C-4504-4325-BD89-9102315858C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "8A1286FE-DB7C-48B1-82A9-A23C82984A21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.0:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "5C89298A-DA7A-4DDD-A420-5B5BC0ABAF7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "60F0CE6D-3DFA-4432-9615-78718C1D5583",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "F478B6AB-8B47-46A2-BEA7-9FF24F4A7026",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "A7CA2655-8B75-4DFF-9B30-1B9839B87D9A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A65F27F5-D134-4B94-BF93-CE32065B75B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "9D976231-5D79-4C48-BFFA-39E3E7FE35A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.2:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "F35ABA0F-6072-433E-AAA5-3B0BB219B404",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1D6E744-5181-4E94-8B9B-3CA83648C7A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "886BD643-B430-4E7A-BC33-50A1B01515D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.3:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "8C469BBE-00A5-4B19-91E4-5C5DF3210BA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5315BD2E-AE5F-49F9-8451-0D2D64CE56B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "087B001A-78B6-46EB-8623-D8C680243867",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.5:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E39EBCE5-FB2E-475E-9EF4-263416315A34",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "5467F5A9-7FFE-4ED6-90A4-490D886B6F01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "252B0169-58A5-4AF4-BB71-08D0A874B616",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.7:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "A67F3E23-4345-449E-83C6-219A08412A09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAFB3374-D0EA-4962-B2B6-4B7A336F874F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "20972E11-0401-4DA2-94D5-2A35F5E1AA95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.8:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "E81D1019-C2A1-47CA-B3C9-D208BFDE1391",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "45AD36C4-069B-4A2F-ACAE-E2EF7BC1CA4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "15112BC0-8C03-4417-A0EB-123C326E6F34",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "685B747F-6C34-4D76-B1A3-652EF2480D5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bestpractical:rt:4.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8E6D6E2-13A1-4AF9-B1A2-414588CCBD35",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket.  NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Cross-site scripting (XSS) en Request Tracker (RT) v4.x anterior a v4.0.13, cuando se configura MakeClicky,  permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s una URL en un ticket. NOTA: este problema se ha dividido desde CVE-2013-3371 debido a las diferentes versiones afectadas."
    }
  ],
  "id": "CVE-2013-5587",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-08-23T16:55:07.407",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/53505"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/53522"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2012/dsa-2670"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/53505"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/53522"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2012/dsa-2670"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.