CVE-2011-1685 Cross-site request forgery in n/a
Authenticated users can execute arbitrary code via CSRF when external custom fields are enabled in RT.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-1685?
CVE-2011-1685 is a medium-severity vulnerability in n/a, published on 22 Apr 2011. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.
Weakness: CWE-352
Which versions are affected by CVE-2011-1685?
It affects 1 product.
Products include Bestpractical Rt.
How do I fix CVE-2011-1685?
Upgrade to a fixed version.
Is CVE-2011-1685 being exploited?
There is no known exploitation of CVE-2011-1685 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j6xx-f4pg-fp88.