Every CVESearch/Get API key

CVE-2011-4459

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable...

3.5 LowFix available

CVE-2011-4459 is a low vulnerability (CVSS 3.5) in Bestpractical Rt, published May 24, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in request-tracker4 4.0.5-3.

What does this mean?
Severity
3.5 LowCVSS 2.0, NVD
Exploit chance
1.01%EPSS, 63rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.0.5-3request-tracker4 +1 more

Description

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Exploit likelihood

1.01%Down 0.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
request-tracker4
Debian:12
before 4.0.5-3
4.0.5-3
request-tracker3.8
Debian:6.0
From an advisory covering 7 CVEs
before 3.8.8-7+squeeze2, plus listed versions
3.8.8-73.8.8-7+squeeze13.8.8-7+squeeze1~bpo50+1
3.8.8-7+squeeze2

What each source reports

NVD Score used3.5

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
CVE-2011-4459
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
CVE-2011-4459
Updated
2026-11-02
EUVDEUVD-2011-4387No score

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
EUVD-2011-4387
Updated
2026-11-03
GitHub AdvisoriesGHSA-36g9-25qq-8h88No score

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable...

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
GHSA-36g9-25qq-8h88
Updated
2026-11-02
OSVNo score

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
CVE-2011-4459
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4459No score

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.

Record
DEBIAN-CVE-2011-4459
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open