CVE-2011-1690 Open redirect in n/a

Medium 4.3 Published 22 Apr 2011 Updated 6 Aug 2024

Attackers can trick users into sending credentials to an arbitrary server, leading to account takeover in the RT ticketing system.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-1690?

CVE-2011-1690 is a medium-severity vulnerability in n/a, published on 22 Apr 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors.

Weakness: CWE-255

Which versions are affected by CVE-2011-1690?

It affects 1 product.

Products include Bestpractical Rt.

How do I fix CVE-2011-1690?

Upgrade to a fixed version.

Is CVE-2011-1690 being exploited?

There is no known exploitation of CVE-2011-1690 in the wild and no public exploit code.

Sources

Also known as GHSA-9hr3-v7cg-39j6.