Read the docs
TI-2011-03778 Aliases CVE-2011-4311GHSA-mrmw-3cpw-45rf

ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote…

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.

Why it matters now

EPSS 0.01442 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*up to 4.2.2816VulnerableMontala
cpe:2.3:a:montala:resourcespace:2.2.1240:*:*:*:*:*:*:*2.2.1240VulnerableMontala
cpe:2.3:a:montala:resourcespace:2.3.1374:*:*:*:*:*:*:*2.3.1374VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.0.1490:*:*:*:*:*:*:*3.0.1490VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.1.1557:*:*:*:*:*:*:*3.1.1557VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.2.1651:*:*:*:*:*:*:*3.2.1651VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.3.1723:*:*:*:*:*:*:*3.3.1723VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.4.1794:*:*:*:*:*:*:*3.4.1794VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.5.1857:*:*:*:*:*:*:*3.5.1857VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.6.2022:*:*:*:*:*:*:*3.6.2022VulnerableMontala
  • cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:* Versions up to 4.2.2816 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:2.2.1240:*:*:*:*:*:*:* Versions 2.2.1240 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:2.3.1374:*:*:*:*:*:*:* Versions 2.3.1374 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.0.1490:*:*:*:*:*:*:* Versions 3.0.1490 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.1.1557:*:*:*:*:*:*:* Versions 3.1.1557 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.2.1651:*:*:*:*:*:*:* Versions 3.2.1651 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.3.1723:*:*:*:*:*:*:* Versions 3.3.1723 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.4.1794:*:*:*:*:*:*:* Versions 3.4.1794 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.5.1857:*:*:*:*:*:*:* Versions 3.5.1857 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.6.2022:*:*:*:*:*:*:* Versions 3.6.2022 Vulnerable ·Montala
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:montala:resourcespace:3.7.2088:*:*:*:*:*:*:*3.7.2088VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.8.2144:*:*:*:*:*:*:*3.8.2144VulnerableMontala
cpe:2.3:a:montala:resourcespace:3.9.2269:*:*:*:*:*:*:*3.9.2269VulnerableMontala
cpe:2.3:a:montala:resourcespace:4.0.2429:*:*:*:*:*:*:*4.0.2429VulnerableMontala
cpe:2.3:a:montala:resourcespace:4.1.2567:*:*:*:*:*:*:*4.1.2567VulnerableMontala
  • cpe:2.3:a:montala:resourcespace:3.7.2088:*:*:*:*:*:*:* Versions 3.7.2088 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.8.2144:*:*:*:*:*:*:* Versions 3.8.2144 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:3.9.2269:*:*:*:*:*:*:* Versions 3.9.2269 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:4.0.2429:*:*:*:*:*:*:* Versions 4.0.2429 Vulnerable ·Montala
  • cpe:2.3:a:montala:resourcespace:4.1.2567:*:*:*:*:*:*:* Versions 4.1.2567 Vulnerable ·Montala

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4311
  2. 2026-10-03 Alias added: GHSA-mrmw-3cpw-45rf

References

Patch 1

Other 2

  • TI-2021-18410 A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5… CVSS 3.1CRITICAL 9.8
  • TI-2021-18505 A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote… CVSS 3.1CRITICAL 9.1
  • TI-2019-15715 ResourceSpace 8.6 SQL Injection via watched_searches.php CVSS 4.0HIGH 8.8
  • TI-2021-18506 ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting… CVSS 3.1MEDIUM 6.1
  • TI-2019-15745 ResourceSpace 8.6 SQL Injection via collection_edit.php CVSS 4.0HIGH 7.1
  • TI-2015-03087 Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace… CVSS 2.0HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences