PT-2011-3292 · Best Practical Solutions · Rt

Vincent Danen · Publicado 2011-04-22 · Atualizado 2017-08-17 · CVE-2011-1685

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7

Description The issue allows remote authenticated users to execute arbitrary code via unspecified vectors when the CustomFieldValuesSources option is enabled. This can be demonstrated by a cross-site request forgery (CSRF) attack.

Recommendations For versions 3.8.0 through 3.8.9, disable the CustomFieldValuesSources option to prevent exploitation. For versions 4.0.0rc through 4.0.0rc7, disable the CustomFieldValuesSources option to prevent exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-1685

DSA-2220-1

Produtos afetados

Rt

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2011-1685 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66791 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1685 · Nota
• http://securityfocus.com/bid/47383 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html · Correção
• http://secunia.com/advisories/44189 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=696795 · Correção
• http://vupen.com/english/advisories/2011/1071 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html · Correção
• http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2220 · Aviso do Fabricante