CVE-2013-3370: Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to priva...

Security readout for executives and security teams

Request Tracker had an access-control flaw in private callback components. A remote attacker could directly request those components and cause an unspecified impact. The public record names fixed releases, but does not describe business impact, CVSS severity, or exploitation in the wild. Exposure is limited to organizations running affected Request Tracker versions, especially externally reachable RT web deployments. The bundled CPE data is incomplete, so asset confirmation must rely on local RT version and package inventory. Prioritize remediation if RT supports customer service, security operations, or regulated workflows. The issue is old and fixed releases exist, but public severity data is incomplete; confirm exposure before assigning emergency status. Mitigation focus: Upgrade RT 3.8.x systems to 3.8.17 or later.; Upgrade RT 4.0.x systems to 4.0.13 or later.; Check Best Practical release notes for version-specific upgrade guidance..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.