PT-2023-6733 · Best Practical+2 · Request Tracker+2

Tom Wolters · Published 2023-10-30 · Updated 2025-08-13 · CVE-2023-41259

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Request Tracker (RT) versions 4.4.6 and earlier Best Practical Request Tracker (RT) versions 5.0.4 and earlier

Description The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. This is due to insufficient cleaning of user-provided data when processing email headers. Exploitation of the issue may allow a remote attacker to execute arbitrary HTML code by sending a specially crafted email message.

Recommendations For versions 4.4.6 and earlier, update to version 4.4.7 or later. For versions 5.0.4 and earlier, update to version 5.0.5 or later. As a temporary workaround, consider restricting access to the mail-gateway REST API call until a patch is available.

Fix

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

BDU:2023-07488

BDU:2023-07509

CVE-2023-41259

DLA-3642-1

DSA-5541-1

DSA-5542-1

USN-6529-1

USN-7692-1

Affected Products

Linuxmint

Request Tracker

Ubuntu

References · 43

• https://ubuntu.com/security/CVE-2021-38562 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5542-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5541 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41259 · Security Note
• https://ubuntu.com/security/CVE-2025-2545 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6529-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-31500 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07509 · Security Note
• https://osv.dev/vulnerability/DSA-5541-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41259 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41259 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41260 · Vendor Advisory
• https://debian.org/security/2023/dsa-5542 · Vendor Advisory