Unscored severity · published Jun 4, 2012
CVE-2011-2085
Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
RT · Bestpractical
through 3.8.11; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2085
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html
Patch
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000203.html
Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000204.html
secunia.com
http://secunia.com/advisories/49259
www.securityfocus.com
http://www.securityfocus.com/bid/53660
lists.apache.org
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
More from RT
9.1
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
8.8
CVE-2026-41075
RT: SQL injection via entry_aggregator parameter in JSON search
8.1
CVE-2026-41076
RT: LDAP authentication bypass via empty password
7.1
CVE-2026-41074
RT has broken CSRF protection for authenticated users
6.1
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart