Rt For Incident Response
Monthly
Stored cross-site scripting in RTIR 6.x before 6.0.4 allows an unauthenticated sender of an emailed Incident Report to plant script in a ticket subject that executes in an incident handler's RT session. Because RTIR grants everyone the right to create Incident Reports by default, the attacker controls the subject without any credentials; the payload fires only when an authenticated handler opens the ticket-split form or the create-incident-from-report form, which render that subject without HTML escaping. Impact is therefore limited to the acting handler's RT authority, and the vendor states the issue is fully fixed by upgrading to RTIR 6.0.4, with RTIR 5.0 explicitly unaffected; no public exploit code was identified at time of analysis and the source is not listed as actively exploited (no CISA KEV entry).
Stored cross-site scripting in RTIR (RT for Incident Response) allows an attacker to persist a crafted javascript: link in an RT ticket because RTIR's internal-link placeholder whitelist accepts any link containing the placeholder, and the script executes in a logged-in user's RT session when that user clicks it. Once RTIR is installed the weakened scrubber applies to the whole RT instance, so anyone able to add HTML ticket content, including an unauthenticated sender to the default-open Incident Reports queue, can store the link; the CVSS:4.0 vector has PR:N but UI:P, and the impact is bounded by the clicking user's RT authority. The vendor-released fix is in 5.0.11 and 6.0.4; no public exploit identified at time of analysis.
Stored cross-site scripting in RTIR 6.x before 6.0.4 allows an unauthenticated sender of an emailed Incident Report to plant script in a ticket subject that executes in an incident handler's RT session. Because RTIR grants everyone the right to create Incident Reports by default, the attacker controls the subject without any credentials; the payload fires only when an authenticated handler opens the ticket-split form or the create-incident-from-report form, which render that subject without HTML escaping. Impact is therefore limited to the acting handler's RT authority, and the vendor states the issue is fully fixed by upgrading to RTIR 6.0.4, with RTIR 5.0 explicitly unaffected; no public exploit code was identified at time of analysis and the source is not listed as actively exploited (no CISA KEV entry).
Stored cross-site scripting in RTIR (RT for Incident Response) allows an attacker to persist a crafted javascript: link in an RT ticket because RTIR's internal-link placeholder whitelist accepts any link containing the placeholder, and the script executes in a logged-in user's RT session when that user clicks it. Once RTIR is installed the weakened scrubber applies to the whole RT instance, so anyone able to add HTML ticket content, including an unauthenticated sender to the default-open Incident Reports queue, can store the link; the CVSS:4.0 vector has PR:N but UI:P, and the impact is bounded by the clicking user's RT authority. The vendor-released fix is in 5.0.11 and 6.0.4; no public exploit identified at time of analysis.