CVE-2011-1685

Severity Score

4.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.

Best Practical Solutions RT v2.0.0 hasta v3.6.10, v3.8.0 hasta v3.8.9, y v4.0.0rc hasta 4.0.0rc7 cuando el campo CustomFieldValuesSources (también conocido como campo personalizado externo) está activada, permite a usuarios remotos autenticados, ejecutar código arbitrario a través de vectores no especificados, como lo demuestra un ataque falsificación de petición en sitios cruzados (CSRF)

*Credits: N/A

CVSS Scores

NISTv2 4.6

Attack Vector

Network

Attack Complexity

High

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-04-13 CVE Reserved
2011-04-19 CVE Published
2023-12-11 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (9)

URL	Tag	Source
http://www.securityfocus.com/bid/47383	Vdb Entry
http://www.vupen.com/english/advisories/2011/1071	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/66791	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html	2017-08-17
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html	2017-08-17
https://bugzilla.redhat.com/show_bug.cgi?id=696795	2017-08-17

URL	Date	SRC
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html	2017-08-17
http://secunia.com/advisories/44189	2017-08-17
http://www.debian.org/security/2011/dsa-2220	2017-08-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.0 Search vendor "Bestpractical" for product "Rt" and version "3.8.0"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.1 Search vendor "Bestpractical" for product "Rt" and version "3.8.1"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.2 Search vendor "Bestpractical" for product "Rt" and version "3.8.2"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.3 Search vendor "Bestpractical" for product "Rt" and version "3.8.3"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.4 Search vendor "Bestpractical" for product "Rt" and version "3.8.4"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.5 Search vendor "Bestpractical" for product "Rt" and version "3.8.5"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.6 Search vendor "Bestpractical" for product "Rt" and version "3.8.6"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.6 Search vendor "Bestpractical" for product "Rt" and version "3.8.6"		rc1		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.7 Search vendor "Bestpractical" for product "Rt" and version "3.8.7"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.7 Search vendor "Bestpractical" for product "Rt" and version "3.8.7"		rc1		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.8 Search vendor "Bestpractical" for product "Rt" and version "3.8.8"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.8 Search vendor "Bestpractical" for product "Rt" and version "3.8.8"		rc2		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.8 Search vendor "Bestpractical" for product "Rt" and version "3.8.8"		rc3		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.8 Search vendor "Bestpractical" for product "Rt" and version "3.8.8"		rc4		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.9 Search vendor "Bestpractical" for product "Rt" and version "3.8.9"		-		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.9 Search vendor "Bestpractical" for product "Rt" and version "3.8.9"		rc1		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.9 Search vendor "Bestpractical" for product "Rt" and version "3.8.9"		rc2		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				3.8.9 Search vendor "Bestpractical" for product "Rt" and version "3.8.9"		rc3		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc1		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc2		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc3		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc4		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc5		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc6		Affected
Bestpractical Search vendor "Bestpractical"		Rt Search vendor "Bestpractical" for product "Rt"				4.0.0 Search vendor "Bestpractical" for product "Rt" and version "4.0.0"		rc7		Affected