Unscored severity · published Apr 22, 2011
CVE-2011-1685
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
RT · Bestpractical
3.8.0; 3.8.1; 3.8.2; 3.8.3; 3.8.4; 3.8.5; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1685
Vendor Advisory
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html
Vendor Advisory
http://secunia.com/advisories/44189
www.debian.org
http://www.debian.org/security/2011/dsa-2220
www.securityfocus.com
http://www.securityfocus.com/bid/47383
More from RT
9.1
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
8.8
CVE-2026-41075
RT: SQL injection via entry_aggregator parameter in JSON search
8.1
CVE-2026-41076
RT: LDAP authentication bypass via empty password
7.1
CVE-2026-41074
RT has broken CSRF protection for authenticated users
6.1
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart