Vulnerability-Lookup

ubuntu-cve-2025-31500

Vulnerability from osv_ubuntu

Published

2025-05-28 18:15

Modified

2026-01-20 05:27

Summary

Details

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Severity

7.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-31500	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-31500	REPORT
	https://ubuntu.com/security/notices/USN-7692-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.1+dfsg-1ubuntu1+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1+dfsg-1ubuntu1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.5+dfsg-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.5+dfsg-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.5+dfsg-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.",
  "id": "UBUNTU-CVE-2025-31500",
  "modified": "2026-01-20T05:27:25Z",
  "published": "2025-05-28T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-31500"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31500"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7692-1"
    }
  ],
  "related": [
    "USN-7692-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-31500"
  ]
}

CVE-2025-31500 (GCVE-0-2025-31500)

Vulnerability from cvelistv5 – Published: 2025-05-28 00:00 – Updated: 2025-05-28 17:59

Summary

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

mitre

References

2 references

URL	Tags
https://docs.bestpractical.com/release-notes/rt/i…
https://docs.bestpractical.com/release-notes/rt/5.0.8

Impacted products

1 product

Vendor	Product	Version
bestpractical	RT	Affected: 5.0.0 , < 5.0.8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-28T17:59:42.444191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-28T17:59:47.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RT",
          "vendor": "bestpractical",
          "versions": [
            {
              "lessThan": "5.0.8",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.8",
                  "versionStartIncluding": "5.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-28T17:45:41.901Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://docs.bestpractical.com/release-notes/rt/index.html"
        },
        {
          "url": "https://docs.bestpractical.com/release-notes/rt/5.0.8"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-31500",
    "datePublished": "2025-05-28T00:00:00.000Z",
    "dateReserved": "2025-03-28T00:00:00.000Z",
    "dateUpdated": "2025-05-28T17:59:47.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-7692-1

Vulnerability from osv_ubuntu

Published

2025-08-13 15:40

Modified

2026-04-27 14:11

Summary

request-tracker5 vulnerabilities

Details

It was discovered that Request Tracker was susceptible to timing attacks. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38562)

It was discovered that Request Tracker was susceptible to cross-site scripting attacks when malicious attachments were supplied. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-25802)

It was discovered that Request Tracker would incorrectly redirect users in certain instances. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-25803)

Tom Wolters discovered that Request Tracker could leak information when malicious email headers were supplied. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-41259, CVE-2023-41260)

It was discovered that Request Tracker could leak information through its transaction search. An attacker with access to the transaction query builder of Request Tracker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-45024)

It was discovered that Request Tracker erroneously stored ticket information in a web browser's cache. An attacker with direct access to a system could possibly use this issue to access sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3262)

It was discovered that Request Tracker made use of an obsolete cryptographic algorithm for emails sent with S/MIME encryption. An attacker could possibly use this issue to access sensitive information. (CVE-2025-2545)

It was discovered that Request Tracker was susceptible to cross-site scripting attacks when malicious parameters were included in a search URL. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-30087)

It was discovered that Request Tracker was susceptible to cross-site scripting attacks when malicious permalinks or assets were provided. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-31500, CVE-2025-31501)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7692-1	ADVISORY
	https://ubuntu.com/security/CVE-2021-38562	REPORT
	https://ubuntu.com/security/CVE-2022-25802	REPORT
	https://ubuntu.com/security/CVE-2022-25803	REPORT
	https://ubuntu.com/security/CVE-2023-41259	REPORT
	https://ubuntu.com/security/CVE-2023-41260	REPORT
	https://ubuntu.com/security/CVE-2023-45024	REPORT
	https://ubuntu.com/security/CVE-2024-3262	REPORT
	https://ubuntu.com/security/CVE-2025-2545	REPORT
	https://ubuntu.com/security/CVE-2025-30087	REPORT
	https://ubuntu.com/security/CVE-2025-31500	REPORT
	https://ubuntu.com/security/CVE-2025-31501	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-38562",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-25802",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-25803",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-41259",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-41260",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-45024",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3262",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-2545",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-30087",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-31500",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-31501",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.1+dfsg-1ubuntu1+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1+dfsg-1ubuntu1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-3262",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-2545",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-30087",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-31500",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-31501",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.5+dfsg-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.5+dfsg-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.5+dfsg-2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Request Tracker was susceptible to timing\nattacks. An attacker could possibly use this issue to access sensitive\ninformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38562)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious attachments were supplied. An attacker\ncould possibly use this issue to execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2022-25802)\n\nIt was discovered that Request Tracker would incorrectly redirect users\nin certain instances. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2022-25803)\n\nTom Wolters discovered that Request Tracker could leak information when\nmalicious email headers were supplied. An attacker could possibly\nuse this issue to access sensitive information. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2023-41259, CVE-2023-41260)\n\nIt was discovered that Request Tracker could leak information through\nits transaction search. An attacker with access to the transaction\nquery builder of Request Tracker could possibly use this issue to\naccess sensitive information. This issue only affected Ubuntu 22.04\nLTS. (CVE-2023-45024)\n\nIt was discovered that Request Tracker erroneously stored ticket\ninformation in a web browser\u0027s cache. An attacker with direct access to\na system could possibly use this issue to access sensitive information.\nThis issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-3262)\n\nIt was discovered that Request Tracker made use of an obsolete\ncryptographic algorithm for emails sent with S/MIME encryption. An\nattacker could possibly use this issue to access sensitive information.\n(CVE-2025-2545)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious parameters were included in a search\nURL. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2025-30087)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious permalinks or assets were provided.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-31500, CVE-2025-31501)",
  "id": "USN-7692-1",
  "modified": "2026-04-27T14:11:45Z",
  "published": "2025-08-13T15:40:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7692-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-38562"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-25802"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-25803"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41259"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41260"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-45024"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-3262"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-2545"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-30087"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-31500"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-31501"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "request-tracker5 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-38562",
    "UBUNTU-CVE-2022-25802",
    "UBUNTU-CVE-2022-25803",
    "UBUNTU-CVE-2023-41259",
    "UBUNTU-CVE-2023-41260",
    "UBUNTU-CVE-2023-45024",
    "UBUNTU-CVE-2024-3262",
    "UBUNTU-CVE-2025-2545",
    "UBUNTU-CVE-2025-30087",
    "UBUNTU-CVE-2025-31500",
    "UBUNTU-CVE-2025-31501"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2025-31500

Vulnerability from osv_ubuntu

CVE-2025-31500 (GCVE-0-2025-31500)

usn-7692-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature