CVE-2013-3737

Request Tracker MobileUI < 1.04 - Unauthorized Session Reuse and Sensitive Information Exposure

Title source: llm
STIX 2.1

Description

The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/94280
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/53799

Scores

EPSS 0.0144
EPSS Percentile 70.1%

Details

CWE
CWE-200
Status published
Products (13)
bestpractical/request_tracker 4.0.0
bestpractical/request_tracker 4.0.1
bestpractical/request_tracker 4.0.2
bestpractical/request_tracker 4.0.3
bestpractical/request_tracker 4.0.4
bestpractical/request_tracker 4.0.5
bestpractical/request_tracker 4.0.6
bestpractical/request_tracker 4.0.7
bestpractical/request_tracker 4.0.8
bestpractical/request_tracker 4.0.9
... and 3 more
Published Nov 16, 2014
Tracked Since Feb 18, 2026