Description
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
References (7)
Core 7
Core References
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2012/dsa-2670
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/93606
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/53505
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/53522
Scores
EPSS
0.0243
EPSS Percentile
82.2%
Details
CWE
CWE-94
Status
published
Products (18)
bestpractical/rt
4.0.0 (9 CPE variants)
bestpractical/rt
4.0.1 (3 CPE variants)
bestpractical/rt
4.0.2 (3 CPE variants)
bestpractical/rt
4.0.3 (3 CPE variants)
bestpractical/rt
4.0.4
bestpractical/rt
4.0.5 (2 CPE variants)
bestpractical/rt
4.0.6
bestpractical/rt
4.0.7 (2 CPE variants)
bestpractical/rt
4.0.8 (3 CPE variants)
bestpractical/rt
4.0.9
... and 8 more
Published
Aug 23, 2013
Tracked Since
Feb 18, 2026