CVE-2011-0009

Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm...

4.3 MediumFix available

Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.

Exploit likelihood

1.88%Up 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2011-0009
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-0009
Updated: 2026-11-02

EUVDEUVD-2011-0036 No score

Record: EUVD-2011-0036
Updated: 2026-11-03

GitHub AdvisoriesGHSA-297v-jphp-x99g No score

Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm...

Record: GHSA-297v-jphp-x99g
Updated: 2026-11-02

Affected products

bestpractical rt

Affected packages

Affected packages
Package	Affected	Fixed
`request-tracker3.6` Debian:5.0	before 3.6.7-5+lenny5, plus listed versions 3.6.7-53.6.7-5+lenny13.6.7-5+lenny23.6.7-5+lenny33.6.7-5+lenny4	3.6.7-5+lenny5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-0009 is a medium vulnerability (CVSS 4.3) in Bestpractical Rt, published January 22, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in request-tracker3.6 3.6.7-5+lenny5.

References

Show 9 moreShow less