PT-2011-2811 · Best Practical Solutions · Rt

Vincent Danen · Publicado 2011-02-28 · Atualizado 2021-02-25 · CVE-2011-1008

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions prior to 3.8.9

Description The issue allows remote authenticated users to obtain sensitive information via unspecified vectors. This is demonstrated by custom-field value information, related to SQL logging, due to improper access restriction to a TicketObj in a Scrip after a CurrentUser change.

Recommendations For versions prior to 3.8.9, update to version 3.8.9 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1008

Produtos afetados

Rt

Referências · 17

• https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3 · Correção
• http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html · Correção
• http://openwall.com/lists/oss-security/2011/02/22/6 · Correção
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 · Correção
• http://openwall.com/lists/oss-security/2011/02/22/12 · Correção
• http://vupen.com/english/advisories/2011/0475 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/02/24/7 · Nota
• http://openwall.com/lists/oss-security/2011/02/22/16 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65772 · Nota
• http://osvdb.org/71011 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1008 · Nota
• http://openwall.com/lists/oss-security/2011/02/24/8 · Nota
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · Nota
• http://openwall.com/lists/oss-security/2011/02/23/22 · Nota
• http://secunia.com/advisories/43438 · Aviso do Fabricante