CVE-2011-1685

Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack.

• CWE-352

• http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.htmlVendor Advisory
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.htmlPatch
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.htmlPatch
• http://secunia.com/advisories/44189Vendor Advisory
• http://www.debian.org/security/2011/dsa-2220
• http://www.securityfocus.com/bid/47383
• http://www.vupen.com/english/advisories/2011/1071
• https://bugzilla.redhat.com/show_bug.cgi?id=696795Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66791
• http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.htmlVendor Advisory
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.htmlPatch
• http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.htmlPatch
• http://secunia.com/advisories/44189Vendor Advisory
• http://www.debian.org/security/2011/dsa-2220
• http://www.securityfocus.com/bid/47383
• http://www.vupen.com/english/advisories/2011/1071
• https://bugzilla.redhat.com/show_bug.cgi?id=696795Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66791

Published

Apr 22, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-1679ncpfs 2.2.6 and earlier attempts to use (1) ncpmount to appe…
• CVE-2011-1680ncpmount in ncpfs 2.2.6 and earlier does not remove the /etc…
• CVE-2011-1681vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka…
• CVE-2011-1682Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2011-1683IBM WebSphere Application Server (WAS) 6.0.x through 6.0.2.4…
• CVE-2011-1684Heap-based buffer overflow in the MP4_ReadBox_skcr function …
• CVE-2011-1686Multiple SQL injection vulnerabilities in Best Practical Sol…
• CVE-2011-1687Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 thro…
• CVE-2011-1688Directory traversal vulnerability in Best Practical Solution…
• CVE-2011-1689Multiple cross-site scripting (XSS) vulnerabilities in Best …
• CVE-2011-1690Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 t…
• CVE-2011-1691The counterToCSSValue function in CSSComputedStyleDeclaratio…