CVE-2011-1007
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login,...
CVE-2011-1007 is a low vulnerability (CVSS 2.1) in Bestpractical Rt, published February 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 33rd percentile. No source names a fixed version.
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
Exploit likelihood
What each source reports
NVD Score used
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
- Record
CVE-2011-1007- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
- Record
CVE-2011-1007- Updated
- 2026-11-02
EUVDEUVD-2011-1024 No score
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
- Record
EUVD-2011-1024- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8935-mgx5-73v2 No score
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login,...
Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
- Record
GHSA-8935-mgx5-73v2- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
openwall.com/lists/oss-security/2011/02/24/9
bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575
issues.bestpractical.com/Ticket/Display.html?id=15804
Show 14 moreShow less
github.com/bestpractical/rt/commit/917c211820590950f7eb0521f7f43b31aeed44c4
secunia.com/advisories/43438
lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html
exchange.xforce.ibmcloud.com/vulnerabilities/65771
vupen.com/english/advisories/2011/0475
osvdb.org/71012
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-1007