PT-2025-43582 · Unknown · Request Tracker

Mateusz Szymaniec · Published 2025-10-22 · Updated 2025-12-23 · CVE-2025-9158

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Request Tracker versions 5.0.4 through 5.0.8 Request Tracker versions 6.0.0 through 6.0.1

Description The Request Tracker software contains a Stored Cross-Site Scripting (XSS) issue within the calendar invitation parsing feature. The software displays invitation data without proper HTML sanitization, allowing an attacker to execute JavaScript code by sending a crafted email. This execution occurs when a logged-in user views the ticket. The calendar invitation parsing feature is the component affected.

Recommendations Request Tracker versions 5.0.4 through 5.0.8 should be updated. Request Tracker versions 6.0.0 through 6.0.1 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9158

DSA-6031-1

Affected Products

Request Tracker

References · 13

• https://osv.dev/vulnerability/DSA-6031-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9158 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9158 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9158 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9158 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-9158 · Security Note
• https://requesttracker.com/request-tracker · Note
• https://twitter.com/CVEnew/status/1981607290877702526 · Twitter Post
• https://t.me/cveNotify/140130 · Telegram Post
• https://cert.pl/en/posts/2025/10/CVE-2025-9158 · Note
• https://t.me/CVEtracker/35641 · Telegram Post
• https://twitter.com/vigilance_en/status/2003392398139736093 · Twitter Post