CVE-2012-4733 | BDVDB-2026-57097 Detail

Description#

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
http://www.osvdb.org/93611
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
http://secunia.com/advisories/53522

Exploit#

No public exploit known

History#

Version 12013-08-23Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.