CVE-2011-1007: Low severity best practical solutions request tracker vulnerability
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1007?
CVE-2011-1007 is considered a medium severity vulnerability due to its potential to allow credential theft on unattended workstations.
How do I fix CVE-2011-1007?
To fix CVE-2011-1007, upgrade to RT version 3.8.9 or later, which addresses the login form redirection issue.
Who is affected by CVE-2011-1007?
CVE-2011-1007 affects users of Best Practical Solutions RT versions prior to 3.8.9, including specific versions like 3.0.4 and 2.0.7.
What type of attack does CVE-2011-1007 facilitate?
CVE-2011-1007 facilitates a local attack where an attacker can exploit the absence of proper session management to retrieve login credentials.
Is a user login safe in RT versions affected by CVE-2011-1007?
User logins in affected RT versions are not safe due to the vulnerability allowing attackers to use the browser's back button to resubmit the login form.