Description
Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors.
References (10)
Core 10
Core References
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/1071
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html
Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=696795
Various Sources x_refsource_confirm
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66794
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/47383
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2011/dsa-2220
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44189
Scores
EPSS
0.0236
EPSS Percentile
82.0%
Details
CWE
CWE-255
Status
published
Products (20)
bestpractical/rt
3.6.0
bestpractical/rt
3.6.1
bestpractical/rt
3.6.2
bestpractical/rt
3.6.3
bestpractical/rt
3.6.4
bestpractical/rt
3.6.5
bestpractical/rt
3.6.6
bestpractical/rt
3.6.7
bestpractical/rt
3.6.8
bestpractical/rt
3.6.9
... and 10 more
Published
Apr 22, 2011
Tracked Since
Feb 18, 2026