Vulnerability in Bestpractical Rt

CVE-2012-4733

Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.

EPSS: 0.016 (73.8th percentile) — read the EPSS interpretation.

Affected products

Bestpractical Rt — versions 4.0.0, 4.0.1, 4.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-255

References

cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_MLIST)
cve@mitre.org (x_refsource_OSVDB, vdb-entry)
cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)