Launchpad.net

CVE 2012-4732

Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks.

Related bugs and status

CVE-2012-4732 (Candidate) is related to these bugs:

Bug #1004834: Multiple security vulnerabilities in request-tracker3.8

		In	Importance	Status
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu)	Undecided	Invalid
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu Lucid)	Undecided	Fix Released
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu Natty)	Undecided	Invalid
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu Oneiric)	Undecided	Fix Released
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu Precise)	Undecided	Fix Released
1004834	Multiple security vulnerabilities in request-tracker3.8	request-tracker3.8 (Ubuntu Quantal)	Undecided	Invalid

See the

CVE page on Mitre.org for more details.

References

MLIST: [rt-announce] 20121025...
OSVDB: 86714