CVE-2011-4458

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000203.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000204.htmlPatch, Vendor Advisory
http://secunia.com/advisories/49259
http://www.securityfocus.com/bid/53660
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000203.htmlPatch, Vendor Advisory
http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000204.htmlPatch, Vendor Advisory
http://secunia.com/advisories/49259
http://www.securityfocus.com/bid/53660

Timeline

Published: Jun 4, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-44593.5Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users CVE-2011-44606.5SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users CVE-2011-44615.3Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably,CVE-2011-44625.0Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, whi CVE-2011-44654.3Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or H CVE-2011-44867.8Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2 CVE-2011-44876.8SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su CVE-2011-44969.3Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.CVE-2011-44973.3QIS_wizard.htm on the ASUS RT-N56U router with firmware before 1.0.1.4o allows remote attackers to obtain the administrator password via a f CVE-2011-44986.8Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to h CVE-2011-44997.5The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with f CVE-2011-45007.5The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen o