CVE-2022-25802: XSS
Published Jul 14, 2022
·Updated
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
Affected Software
10 affected componentsFixes available
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
ubuntu/request-tracker4<4.4.6
4.4.6
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~
4.4.2-2ubuntu0.1~
ubuntu/request-tracker4<4.4.3-2+
4.4.3-2+
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
debian/request-tracker4
4.4.3-2+deb10u24.4.3-2+deb10u34.4.4+dfsg-2+deb11u24.4.4+dfsg-2+deb11u34.4.6+dfsg-1.1+deb12u14.4.7+dfsg-1
debian/request-tracker5
5.0.3+dfsg-3~deb12u25.0.5+dfsg-2
bestpractical Request Tracker<4.4.6
bestpractical Request Tracker>=5.0.0<5.0.3
Remediation
Patch Available
Patch Available
Event History
Jul 14, 2022
CVE Published
12:00 AM
CVE Published
via MITRE·11:49 AM
Data Sourced
via MITRE·11:49 AM
Description
Dec 4, 2023
Data Sourced
09:08 PM
Description
Frequently Asked Questions
1
What is CVE-2022-25802?
CVE-2022-25802 is a vulnerability in Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 that allows XSS (cross-site scripting) attacks via a crafted content type for an attachment.
2
How severe is CVE-2022-25802?
CVE-2022-25802 has a severity rating of 6.1 (medium).
3
Which software versions are affected by CVE-2022-25802?
Best Practical Request Tracker (RT) versions before 4.4.6 and between 5.0.0 and 5.0.3 are affected by CVE-2022-25802.
4
How can I fix CVE-2022-25802?
To fix CVE-2022-25802, you should upgrade Best Practical Request Tracker (RT) to version 4.4.6 or 5.0.3 or later.
5
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-25802?
The CWE ID for CVE-2022-25802 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).