CVE-2011-1688

EPSS 3.78%
Veröffentlicht 22.04.2011 10:55:02
Zuletzt bearbeitet 16.06.2026 23:29:50
Erkennungen
Login

Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 13

NVD 47 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Bestpractical ≫ Rt Version 3.2.0

Bestpractical ≫ Rt Version 3.2.1

Bestpractical ≫ Rt Version 3.2.2

Bestpractical ≫ Rt Version 3.2.3

Bestpractical ≫ Rt Version 3.4.0

Bestpractical ≫ Rt Version 3.4.1

Bestpractical ≫ Rt Version 3.4.2

Bestpractical ≫ Rt Version 3.4.3

Bestpractical ≫ Rt Version 3.4.4

Bestpractical ≫ Rt Version 3.4.5

Bestpractical ≫ Rt Version 3.4.6

Bestpractical ≫ Rt Version 3.6.0

Bestpractical ≫ Rt Version 3.6.1

Bestpractical ≫ Rt Version 3.6.2

Bestpractical ≫ Rt Version 3.6.3

Bestpractical ≫ Rt Version 3.6.4

Bestpractical ≫ Rt Version 3.6.5

Bestpractical ≫ Rt Version 3.6.6

Bestpractical ≫ Rt Version 3.6.7

Bestpractical ≫ Rt Version 3.6.8

Bestpractical ≫ Rt Version 3.6.9

Bestpractical ≫ Rt Version 3.6.10

Bestpractical ≫ Rt Version 3.8.0

Bestpractical ≫ Rt Version 3.8.1

Bestpractical ≫ Rt Version 3.8.2

Bestpractical ≫ Rt Version 3.8.3

Bestpractical ≫ Rt Version 3.8.4

Bestpractical ≫ Rt Version 3.8.5

Bestpractical ≫ Rt Version 3.8.6

Bestpractical ≫ Rt Version 3.8.6 Update rc1

Bestpractical ≫ Rt Version 3.8.7

Bestpractical ≫ Rt Version 3.8.7 Update rc1

Bestpractical ≫ Rt Version 3.8.8

Bestpractical ≫ Rt Version 3.8.8 Update rc2

Bestpractical ≫ Rt Version 3.8.8 Update rc3

Bestpractical ≫ Rt Version 3.8.8 Update rc4

Bestpractical ≫ Rt Version 3.8.9

Bestpractical ≫ Rt Version 3.8.9 Update rc1

Bestpractical ≫ Rt Version 3.8.9 Update rc2

Bestpractical ≫ Rt Version 3.8.9 Update rc3

Bestpractical ≫ Rt Version 4.0.0 Update rc1

Bestpractical ≫ Rt Version 4.0.0 Update rc2

Bestpractical ≫ Rt Version 4.0.0 Update rc3

Bestpractical ≫ Rt Version 4.0.0 Update rc4

Bestpractical ≫ Rt Version 4.0.0 Update rc5

Bestpractical ≫ Rt Version 4.0.0 Update rc6

Bestpractical ≫ Rt Version 4.0.0 Update rc7

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.78%	0.886

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html

Patch

http://secunia.com/advisories/44189

Vendor Advisory

http://www.debian.org/security/2011/dsa-2220

http://www.securityfocus.com/bid/47383

http://www.vupen.com/english/advisories/2011/1071

https://bugzilla.redhat.com/show_bug.cgi?id=696795

Patch

http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/66795

https://nvd.nist.gov/vuln/detail/CVE-2011-1688

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-1688

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-1688

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2011-1688