CVE-2011-1686

Description

Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/66792

https://bugzilla.redhat.com/show_bug.cgi?id=696795

http://www.vupen.com/english/advisories/2011/1071

http://www.securityfocus.com/bid/47383

http://www.debian.org/security/2011/dsa-2220

http://secunia.com/advisories/44189

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html

http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3