PT-2022-3609 · Unknown+2 · Request Tracker+2

Published 2022-07-13 · Updated 2025-08-13 · CVE-2022-25802

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Request Tracker versions prior to 4.4.6 Request Tracker versions 5.x prior to 5.0.3

Description The issue allows for a cross-site scripting (XSS) attack via a crafted content type for an attachment. This can be exploited by a remote attacker to conduct an XSS attack, potentially allowing them to execute malicious scripts on the victim's browser. The vulnerability exists due to inadequate protection of the web page structure.

Recommendations For versions prior to 4.4.6, update to version 4.4.6 or later. For versions 5.x prior to 5.0.3, update to version 5.0.3 or later. As a temporary workaround, consider restricting the ability to upload attachments with crafted content types until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04394

CVE-2022-25802

DSA-5181-1

USN-6529-1

USN-7692-1

Affected Products

Linuxmint

Request Tracker

Ubuntu

References · 27

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41260 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5181-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25803 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-31500 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6529-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25802 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-25802 · Security Note
• https://ubuntu.com/security/CVE-2022-25802 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6529-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-25802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-30087 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3262 · Vendor Advisory