VulnerabilityModified
CVE-2011-1685
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as…
MEDIUM 4.6EPSS 1.12%
Does this matter?
Lower severity and a low EPSS score (1.12%). Track it; it rarely justifies an emergency change on its own.
Description
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.
- CVSS 2.0
- 4.6 MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- bestpractical/rt
- Source
- cve@mitre.org
References
- http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.htmlVendor Advisory
- http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.htmlPatch
- http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.htmlPatch
- http://secunia.com/advisories/44189Vendor Advisory
- http://www.debian.org/security/2011/dsa-2220
- http://www.securityfocus.com/bid/47383
- http://www.vupen.com/english/advisories/2011/1071
- https://bugzilla.redhat.com/show_bug.cgi?id=696795Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66791
- http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.htmlVendor Advisory
- http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.htmlPatch
- http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.htmlPatch
- http://secunia.com/advisories/44189Vendor Advisory
- http://www.debian.org/security/2011/dsa-2220
- http://www.securityfocus.com/bid/47383
- http://www.vupen.com/english/advisories/2011/1071
- https://bugzilla.redhat.com/show_bug.cgi?id=696795Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66791
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.