CVE-2011-1685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-1685
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:S/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html Patch
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html Patch
http://secunia.com/advisories/44189 Vendor Advisory
http://www.debian.org/security/2011/dsa-2220
http://www.securityfocus.com/bid/47383
http://www.vupen.com/english/advisories/2011/1071
https://bugzilla.redhat.com/show_bug.cgi?id=696795 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/66791
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html Patch
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html Patch
http://secunia.com/advisories/44189 Vendor Advisory
http://www.debian.org/security/2011/dsa-2220
http://www.securityfocus.com/bid/47383
http://www.vupen.com/english/advisories/2011/1071
https://bugzilla.redhat.com/show_bug.cgi?id=696795 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/66791
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*
cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*
History

21 Nov 2024, 01:26

Type Values Removed Values Added
References () http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html - Vendor Advisory () http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html - Vendor Advisory
References () http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html - Patch () http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html - Patch
References () http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html - Patch () http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html - Patch
References () http://secunia.com/advisories/44189 - Vendor Advisory () http://secunia.com/advisories/44189 - Vendor Advisory
References () http://www.debian.org/security/2011/dsa-2220 - () http://www.debian.org/security/2011/dsa-2220 -
References () http://www.securityfocus.com/bid/47383 - () http://www.securityfocus.com/bid/47383 -
References () http://www.vupen.com/english/advisories/2011/1071 - () http://www.vupen.com/english/advisories/2011/1071 -
References () https://bugzilla.redhat.com/show_bug.cgi?id=696795 - Patch () https://bugzilla.redhat.com/show_bug.cgi?id=696795 - Patch
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/66791 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/66791 -
Information

Published : 2011-04-22 10:55

Updated : 2024-11-21 01:26

NVD link : CVE-2011-1685

Mitre link : CVE-2011-1685

CVE.ORG link : CVE-2011-1685

JSON object : View

Products Affected

bestpractical

  • rt
CWE
CWE-352

Cross-Site Request Forgery (CSRF)