PT-2011-3292

CVE-2011-1685

·

Publicado

2011-04-22

·

Atualizado

2017-08-17

Descrição por

CVSS 2.0
4.6
Média
MétricasAV:N/AC:H/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.8.0 through 3.8.9 Best Practical Solutions RT versions 4.0.0rc through 4.0.0rc7
Description The issue allows remote authenticated users to execute arbitrary code via unspecified vectors when the CustomFieldValuesSources option is enabled. This can be demonstrated by a cross-site request forgery (CSRF) attack.
Recommendations For versions 3.8.0 through 3.8.9, disable the CustomFieldValuesSources option to prevent exploitation. For versions 4.0.0rc through 4.0.0rc7, disable the CustomFieldValuesSources option to prevent exploitation.
Explorabilidade
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-352: Cross-Site Request Forgery (CSRF)
Identificadores relacionados
CVE-2011-1685
DSA-2220-1
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com