medium5.0
CVE-2012-4734
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protec…
Impact
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bestpractical | Rt | Versions 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5 |