CVE-2011-1687

Public PoC / Exploit (1)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords.

Weaknesses (CWE)

CWE-200

Affected Products (61)

bestpractical · rtvulnerable

...and 11 more

References (20)

http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html

Patch

http://secunia.com/advisories/44189

Vendor Advisory

http://www.debian.org/security/2011/dsa-2220

http://www.securityfocus.com/bid/47383

http://www.vupen.com/english/advisories/2011/1071

https://bugzilla.redhat.com/show_bug.cgi?id=696795

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/66793

http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html

Patch

http://secunia.com/advisories/44189

Vendor Advisory

http://www.debian.org/security/2011/dsa-2220

http://www.securityfocus.com/bid/47383

http://www.vupen.com/english/advisories/2011/1071

https://bugzilla.redhat.com/show_bug.cgi?id=696795

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/66793