| Name | CVE-2013-5587 |
| Description | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-2671-1 |
| Debian Bugs | 709836 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| request-tracker4 (PTS) | jessie, jessie (lts) | 4.2.8-3+deb8u4 | fixed |
| stretch (security) | 4.4.1-3+deb9u4 | fixed |
| stretch (lts), stretch | 4.4.1-3+deb9u6 | fixed |
| buster (security), buster, buster (lts) | 4.4.3-2+deb10u3 | fixed |
| bullseye (security), bullseye | 4.4.4+dfsg-2+deb11u3 | fixed |
| bookworm (security), bookworm | 4.4.6+dfsg-1.1+deb12u1 | fixed |
| sid, trixie | 4.4.7+dfsg-3 | fixed |
The information below is based on the following data on fixed versions.
Notes
- request-tracker3.8 <not-affected> (only covers the issues in 4.x)
This is covered by the patches applied for CVE-2013-3371 in DSA-2760 and DSA-2761.
NVD explicitly mentions CVE-2013-5587 only for the RT 4.x series.
patch for 3.8.17: https://github.com/bestpractical/rt/compare/rt-3.8.16...rt-3.8.17
patch for 4.0.13: https://github.com/bestpractical/rt/compare/rt-4.0.12...rt-4.0.13
still not clear why the split was done, but confirmed by upstream that this issue
is covered by the fixes applied for CVE-2013-3371