CVE-2013-3369

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-23 · updated 2026-06-16

Description

Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.

Affected products

bestpractical rt: 3.8.0, 3.8.0-preflight1, 3.8.0-rc1, 3.8.0-rc2, 3.8.0-rc3, 3.8.1 (+71)

References

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
http://secunia.com/advisories/53505
http://secunia.com/advisories/53522
http://www.debian.org/security/2012/dsa-2670
http://www.osvdb.org/93610
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
http://secunia.com/advisories/53505
http://secunia.com/advisories/53522

Get alerted when CVE-2013-3369 or the next vulnerability affects your stack