PT-2022-17527 · Best Practical · Rtir

Published 2022-07-14 · Updated 2022-07-21 · CVE-2022-25800

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Best Practical RT for Incident Response (RTIR) versions 4.0.3 and earlier, 5.x versions prior to 5.0.3

Description The issue allows for Server-Side Request Forgery (SSRF) via the whois lookup tool.

Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later. For versions 5.x prior to 5.0.3, update to version 5.0.3 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-25800

Affected Products

Rtir

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-25800 · Security Note
• https://docs.bestpractical.com/release-notes/rtir/5.0.3 · Vendor Advisory
• https://docs.bestpractical.com/release-notes/rtir/index.html · Vendor Advisory
• https://docs.bestpractical.com/release-notes/rtir/4.0.3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25800 · Vendor Advisory
• https://t.me/cibsecurity/46234 · Telegram Post