PT-2025-45645 · Unknown · Request Tracker

Published 2025-01-01 · Updated 2026-01-16 · CVE-2025-61873

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Request Tracker versions prior to 4.4.4+dfsg-2+deb11u5 Request Tracker versions prior to 4.4.6+dfsg-1.1+deb12u3 Request Tracker versions prior to 5.0.3+dfsg-3~deb12u4 Request Tracker versions prior to 5.0.7+dfsg-4+deb13u1

Description Request Tracker, an extensible trouble-ticket tracking system, is affected by issues that could lead to CSV injection via ticket values containing special characters, and cross-site scripting through calendar invitations added to tickets. The CSV injection can occur when exporting ticket values to a TSV from search results.

Recommendations Upgrade Request Tracker packages to version 4.4.4+dfsg-2+deb11u5 or later. Upgrade Request Tracker packages to version 4.4.6+dfsg-1.1+deb12u3 or later. Upgrade Request Tracker packages to version 5.0.3+dfsg-3~deb12u4 or later. Upgrade Request Tracker packages to version 5.0.7+dfsg-4+deb13u1 or later.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-61873

DLA-4349-1

DSA-6031-1

DSA-6032-1

Affected Products

Request Tracker

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61873 · Security Note
• https://osv.dev/vulnerability/DLA-4349-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61873 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61873 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6031-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61873 · Security Note
• https://osv.dev/vulnerability/DSA-6032-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61873 · Vendor Advisory
• https://twitter.com/CVEnew/status/2012303263144755293 · Twitter Post
• https://twitter.com/vigilance_en/status/2003407496405299286 · Twitter Post
• https://docs.bestpractical.com/release-notes/rt/index.html · Note