Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:32
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html - Patch, Vendor Advisory | |
References | () http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000203.html - Patch | |
References | () http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000204.html - Patch | |
References | () http://secunia.com/advisories/49259 - | |
References | () http://www.securityfocus.com/bid/53660 - |
Information
Published : 2012-06-04 19:55
Updated : 2025-04-11 00:51
NVD link : CVE-2011-4459
Mitre link : CVE-2011-4459
CVE.ORG link : CVE-2011-4459
JSON object : View
Products Affected
bestpractical
- rt
CWE
CWE-264
Permissions, Privileges, and Access Controls