CVE-2013-3373: CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Aug 23, 2013

CVE-2013-3373

CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response…

–

CVSS

2.4%

EPSS

No

On KEV

Description

CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.4% · higher than 84% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RT

RT · Bestpractical

4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +34 more · source: NVD

Affected product

RT

RT

Bestpractical

References

https://nvd.nist.gov/vuln/detail/CVE-2013-3373

https://www.cve.org/CVERecord?id=CVE-2013-3373

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html

Vendor Advisory

http://secunia.com/advisories/53505

Vendor Advisory

http://secunia.com/advisories/53522

http://www.debian.org/security/2012/dsa-2670

More from RT

9.1

RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

8.8

RT: SQL injection via entry_aggregator parameter in JSON search

8.1

RT: LDAP authentication bypass via empty password

7.1

RT has broken CSRF protection for authenticated users

6.1

RT: Reflected Cross-Site Scripting in search results chart