Request Tracker (RT) 4.x prior to 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
bestpractical rt 4.0.1 |
||
bestpractical rt 4.0.10 |
||
bestpractical rt 4.0.0 |
||
bestpractical rt 4.0.2 |
||
bestpractical rt 4.0.3 |
||
bestpractical rt 4.0.12 |
||
bestpractical rt 4.0.11 |
Vulmon