Cross-Site Scripting Vulnerability in Best Practical RT Software
CVE-2025-31501

6.1MEDIUM

Key Information:

Vendor

Bestpractical

Status
Rt
Vendor
CVE Published:
28 May 2025

What is CVE-2025-31501?

The software is susceptible to cross-site scripting due to improper validation of input in RT permalinks, allowing attackers to inject malicious JavaScript. This can lead to unauthorized actions on behalf of users, compromise sensitive data, and create further security risks if not patched.

Affected Version(s)

RT 5.0.0 < 5.0.8

References

https://docs.bestpractical.com/release-notes/rt/index.html
https://docs.bestpractical.com/release-notes/rt/5.0.8

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.