CVE-2013-3374 Affecting request-tracker4 package, versions <4.0.12-2


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.6% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN10-REQUESTTRACKER4-417158
  • published23 Aug 2013
  • disclosed23 Aug 2013

Introduced: 23 Aug 2013

CVE-2013-3374  (opens in a new tab)

How to fix?

Upgrade Debian:10 request-tracker4 to version 4.0.12-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream request-tracker4 package and not the request-tracker4 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."

CVSS Scores

version 3.1