Unscored severity · published Nov 19, 2011
CVE-2011-4311
ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors
–
CVSS
1.4%
EPSS
No
On KEV
Description
ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Resourcespace · Montala
through 4.2.2816; 2.2.1240; 2.3.1374; 3.0.1490; 3.1.1557; 3.2.1651; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4311
openwall.com
http://openwall.com/lists/oss-security/2011/11/13/2
openwall.com
http://openwall.com/lists/oss-security/2011/11/14/3
Patch
http://www.resourcespace.org/download.php
More from Resourcespace
9.8
CVE-2021-41765
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL…
9.1
CVE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the…
7.5
CVE-2019-25662
ResourceSpace 8.6 SQL Injection via watched_searches.php
7.1
CVE-2019-25693
ResourceSpace 8.6 SQL Injection via collection_edit.php
6.5
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value