CVE-2011-1008

Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.

• CWE-264

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576Patch
• http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.htmlPatch
• http://openwall.com/lists/oss-security/2011/02/22/12Patch
• http://openwall.com/lists/oss-security/2011/02/22/16Patch
• http://openwall.com/lists/oss-security/2011/02/22/6Patch
• http://openwall.com/lists/oss-security/2011/02/23/22
• http://openwall.com/lists/oss-security/2011/02/24/7
• http://openwall.com/lists/oss-security/2011/02/24/8
• http://openwall.com/lists/oss-security/2011/02/24/9
• http://osvdb.org/71011
• http://secunia.com/advisories/43438Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0475Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65772
• https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3Patch
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576Patch
• http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.htmlPatch
• http://openwall.com/lists/oss-security/2011/02/22/12Patch
• http://openwall.com/lists/oss-security/2011/02/22/16Patch
• http://openwall.com/lists/oss-security/2011/02/22/6Patch
• http://openwall.com/lists/oss-security/2011/02/23/22
• http://openwall.com/lists/oss-security/2011/02/24/7
• http://openwall.com/lists/oss-security/2011/02/24/8
• http://openwall.com/lists/oss-security/2011/02/24/9
• http://osvdb.org/71011
• http://secunia.com/advisories/43438Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0475Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65772
• https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3Patch
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

Published

Feb 28, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-10040Nagios XI versions prior to 2011R1.9 are vulnerable to cross…5.4
• CVE-2011-10041Uploadify WordPress plugin versions up to and including 1.0 …9.3
• CVE-2011-10043Module::Load versions before 0.22 for Perl allow arbitrary m…9.8
• CVE-2011-1005The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.…
• CVE-2011-1006Heap-based buffer overflow in the parse_cgroup_spec function…
• CVE-2011-1007Best Practical Solutions RT before 3.8.9 does not perform ce…
• CVE-2011-1009Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla…6.1
• CVE-2011-1010Buffer overflow in the mac_partition function in fs/partitio…
• CVE-2011-1011The seunshare_mount function in sandbox/seunshare.c in seuns…
• CVE-2011-1012The ldm_parse_vmdb function in fs/partitions/ldm.c in the Li…
• CVE-2011-1013Integer signedness error in the drm_modeset_ctl function in …
• CVE-2011-1014Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…