Best Practical Solutions
Monthly
Stored cross-site scripting in Best Practical Solutions' Request Tracker lets an attacker plant script inside a ticket, which then executes in the session of any RT user who opens that ticket's history. The flaw is in RT's automatic URL-to-link conversion for HTML ticket content, which fails to HTML-escape the URL it writes into the link, so a crafted URL breaks out of the address and injects script. Anyone who can add HTML content to a ticket can plant it - including an unauthenticated sender of HTML email to a queue that grants CreateTicket or ReplyToTicket to Everyone, which removes any authentication requirement (the assessed vector carries PR:N); the script then acts with the viewing user's RT authority, not system-level access. Fixed in 5.0.11 and 6.0.4; no public exploit identified at time of analysis, and no CISA KEV listing.
Stored cross-site scripting in RTIR 6.x before 6.0.4 allows an unauthenticated sender of an emailed Incident Report to plant script in a ticket subject that executes in an incident handler's RT session. Because RTIR grants everyone the right to create Incident Reports by default, the attacker controls the subject without any credentials; the payload fires only when an authenticated handler opens the ticket-split form or the create-incident-from-report form, which render that subject without HTML escaping. Impact is therefore limited to the acting handler's RT authority, and the vendor states the issue is fully fixed by upgrading to RTIR 6.0.4, with RTIR 5.0 explicitly unaffected; no public exploit code was identified at time of analysis and the source is not listed as actively exploited (no CISA KEV entry).
Stored cross-site scripting in RTIR (RT for Incident Response) allows an attacker to persist a crafted javascript: link in an RT ticket because RTIR's internal-link placeholder whitelist accepts any link containing the placeholder, and the script executes in a logged-in user's RT session when that user clicks it. Once RTIR is installed the weakened scrubber applies to the whole RT instance, so anyone able to add HTML ticket content, including an unauthenticated sender to the default-open Incident Reports queue, can store the link; the CVSS:4.0 vector has PR:N but UI:P, and the impact is bounded by the clicking user's RT authority. The vendor-released fix is in 5.0.11 and 6.0.4; no public exploit identified at time of analysis.
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the RTFM extension 2.0.4 through 2.4.3 for Best Practical Solutions RT allow remote attackers to inject. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Stored cross-site scripting in Best Practical Solutions' Request Tracker lets an attacker plant script inside a ticket, which then executes in the session of any RT user who opens that ticket's history. The flaw is in RT's automatic URL-to-link conversion for HTML ticket content, which fails to HTML-escape the URL it writes into the link, so a crafted URL breaks out of the address and injects script. Anyone who can add HTML content to a ticket can plant it - including an unauthenticated sender of HTML email to a queue that grants CreateTicket or ReplyToTicket to Everyone, which removes any authentication requirement (the assessed vector carries PR:N); the script then acts with the viewing user's RT authority, not system-level access. Fixed in 5.0.11 and 6.0.4; no public exploit identified at time of analysis, and no CISA KEV listing.
Stored cross-site scripting in RTIR 6.x before 6.0.4 allows an unauthenticated sender of an emailed Incident Report to plant script in a ticket subject that executes in an incident handler's RT session. Because RTIR grants everyone the right to create Incident Reports by default, the attacker controls the subject without any credentials; the payload fires only when an authenticated handler opens the ticket-split form or the create-incident-from-report form, which render that subject without HTML escaping. Impact is therefore limited to the acting handler's RT authority, and the vendor states the issue is fully fixed by upgrading to RTIR 6.0.4, with RTIR 5.0 explicitly unaffected; no public exploit code was identified at time of analysis and the source is not listed as actively exploited (no CISA KEV entry).
Stored cross-site scripting in RTIR (RT for Incident Response) allows an attacker to persist a crafted javascript: link in an RT ticket because RTIR's internal-link placeholder whitelist accepts any link containing the placeholder, and the script executes in a logged-in user's RT session when that user clicks it. Once RTIR is installed the weakened scrubber applies to the whole RT instance, so anyone able to add HTML ticket content, including an unauthenticated sender to the default-open Incident Reports queue, can store the link; the CVSS:4.0 vector has PR:N but UI:P, and the impact is bounded by the clicking user's RT authority. The vendor-released fix is in 5.0.11 and 6.0.4; no public exploit identified at time of analysis.
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the RTFM extension 2.0.4 through 2.4.3 for Best Practical Solutions RT allow remote attackers to inject. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.