Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-1008

Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.

Published

2011-02-28T16:00:01.680

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	bestpractical	rt	≤ 3.8.9	Yes
Application	bestpractical	rt	1.0.0	Yes
Application	bestpractical	rt	1.0.1	Yes
Application	bestpractical	rt	1.0.2	Yes
Application	bestpractical	rt	1.0.3	Yes
Application	bestpractical	rt	1.0.4	Yes
Application	bestpractical	rt	1.0.5	Yes
Application	bestpractical	rt	1.0.6	Yes
Application	bestpractical	rt	1.0.7	Yes
Application	bestpractical	rt	2.0.0	Yes
Application	bestpractical	rt	2.0.1	Yes
Application	bestpractical	rt	2.0.2	Yes
Application	bestpractical	rt	2.0.3	Yes
Application	bestpractical	rt	2.0.4	Yes
Application	bestpractical	rt	2.0.5	Yes
Application	bestpractical	rt	2.0.5.1	Yes
Application	bestpractical	rt	2.0.5.3	Yes
Application	bestpractical	rt	2.0.6	Yes
Application	bestpractical	rt	2.0.7	Yes
Application	bestpractical	rt	2.0.8	Yes
Application	bestpractical	rt	2.0.8.2	Yes
Application	bestpractical	rt	2.0.9	Yes
Application	bestpractical	rt	2.0.11	Yes
Application	bestpractical	rt	2.0.12	Yes
Application	bestpractical	rt	2.0.13	Yes
Application	bestpractical	rt	2.0.14	Yes
Application	bestpractical	rt	2.0.15	Yes
Application	bestpractical	rt	3.0.0	Yes
Application	bestpractical	rt	3.0.1	Yes
Application	bestpractical	rt	3.0.2	Yes
Application	bestpractical	rt	3.0.3	Yes
Application	bestpractical	rt	3.0.4	Yes
Application	bestpractical	rt	3.0.5	Yes
Application	bestpractical	rt	3.0.6	Yes
Application	bestpractical	rt	3.0.7	Yes
Application	bestpractical	rt	3.0.7.1	Yes
Application	bestpractical	rt	3.0.8	Yes
Application	bestpractical	rt	3.0.9	Yes
Application	bestpractical	rt	3.0.10	Yes
Application	bestpractical	rt	3.0.11	Yes
Application	bestpractical	rt	3.0.12	Yes
Application	bestpractical	rt	3.2.0	Yes
Application	bestpractical	rt	3.2.1	Yes
Application	bestpractical	rt	3.2.2	Yes
Application	bestpractical	rt	3.2.3	Yes
Application	bestpractical	rt	3.4.0	Yes
Application	bestpractical	rt	3.4.1	Yes
Application	bestpractical	rt	3.4.2	Yes
Application	bestpractical	rt	3.4.3	Yes
Application	bestpractical	rt	3.4.4	Yes
Application	bestpractical	rt	3.4.5	Yes
Application	bestpractical	rt	3.4.6	Yes
Application	bestpractical	rt	3.6.0	Yes
Application	bestpractical	rt	3.6.1	Yes
Application	bestpractical	rt	3.6.2	Yes
Application	bestpractical	rt	3.6.3	Yes
Application	bestpractical	rt	3.6.4	Yes
Application	bestpractical	rt	3.6.5	Yes
Application	bestpractical	rt	3.6.6	Yes
Application	bestpractical	rt	3.6.7	Yes
Application	bestpractical	rt	3.6.8	Yes
Application	bestpractical	rt	3.6.9	Yes
Application	bestpractical	rt	3.8.0	Yes
Application	bestpractical	rt	3.8.1	Yes
Application	bestpractical	rt	3.8.2	Yes
Application	bestpractical	rt	3.8.3	Yes
Application	bestpractical	rt	3.8.4	Yes
Application	bestpractical	rt	3.8.5	Yes
Application	bestpractical	rt	3.8.6	Yes
Application	bestpractical	rt	3.8.6	Yes
Application	bestpractical	rt	3.8.7	Yes
Application	bestpractical	rt	3.8.8	Yes
Application	bestpractical	rt	3.8.8	Yes
Application	bestpractical	rt	3.8.8	Yes
Application	bestpractical	rt	3.8.9	Yes
Application	bestpractical	rt	3.8.9	Yes

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 Patch ([email protected])
http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html Patch ([email protected])
http://openwall.com/lists/oss-security/2011/02/22/12 Patch ([email protected])
http://openwall.com/lists/oss-security/2011/02/22/16 Patch ([email protected])
http://openwall.com/lists/oss-security/2011/02/22/6 Patch ([email protected])
http://openwall.com/lists/oss-security/2011/02/23/22 ([email protected])
http://openwall.com/lists/oss-security/2011/02/24/7 ([email protected])
http://openwall.com/lists/oss-security/2011/02/24/8 ([email protected])
http://openwall.com/lists/oss-security/2011/02/24/9 ([email protected])
http://osvdb.org/71011 ([email protected])
http://secunia.com/advisories/43438 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2011/0475 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/65772 ([email protected])
https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3 Patch ([email protected])
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E ([email protected])
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html Patch (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/22/12 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/22/16 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/22/6 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/23/22 (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/24/7 (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/24/8 (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2011/02/24/9 (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/71011 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/43438 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2011/0475 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/65772 (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)