{"id":"CVE-2011-4458","aliases":["DEBIAN-CVE-2011-4458","DSA-2480-1","EUVD-2011-4386","GHSA-397q-whxp-h2p3"],"status":"published","title":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the...","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.03066,"percentile":0.87686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2012-05-24T00:00:00Z","modified":"2026-10-23T17:47:47Z","fixes":[{"ecosystem":"Debian:12","package":"request-tracker4","fixed_in":["4.0.5-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"request-tracker3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-7+squeeze2"}]}],"versions":["3.8.8-7","3.8.8-7+squeeze1","3.8.8-7+squeeze1~bpo50+1"],"bundled":7}],"products":[{"vendor":"bestpractical","product":"rt"}],"references":[{"url":"http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000203.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/49259","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000204.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.bestpractical.com/pipermail/rt-announce/2012-May/000202.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/53660","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4458"},{"url":"https://github.com/advisories/GHSA-397q-whxp-h2p3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4458","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-4458","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2012-06-04T19:00:00Z","modified":"2024-08-07T00:09:18.415Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2011-4386","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2012-06-04T19:00:00Z","modified":"2024-08-07T00:09:18Z","updated_at":"2026-11-03T01:39:48.961231Z"}],"ghsa":[{"id":"GHSA-397q-whxp-h2p3","title":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the...","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2022-05-17T05:20:48Z","modified":"2023-01-28T05:03:58Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:44:04.962891Z"}],"nvd":[{"id":"CVE-2011-4458","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2012-06-04T19:55:01.727Z","modified":"2026-06-16T23:34:55.18Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:12.272092Z"}],"osv":[{"id":"CVE-2011-4458","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2012-06-04T19:55:01Z","modified":"2026-04-10T03:42:05.043329Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-4458","description":"Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.","status":"published","published":"2012-06-04T19:55:01.727Z","modified":"2026-10-23T17:47:47.46649641Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DSA-2480-1","title":"request-tracker3.8 - several","status":"published","published":"2012-05-24T00:00:00Z","modified":"2026-03-09T01:17:50.923357Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}