Skip to content
OpenAdvisories
High USN-7692-1 11 CVEs

request-tracker5 vulnerabilities

Published Aug 13, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Request Tracker was susceptible to timing
attacks. An attacker could possibly use this issue to access sensitive
information. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38562)

It was discovered that Request Tracker was susceptible to cross-site
scripting attacks when malicious attachments were supplied. An attacker
could possibly use this issue to execute arbitrary code. This issue
only affected Ubuntu 22.04 LTS. (CVE-2022-25802)

It was discovered that Request Tracker would incorrectly redirect users
in certain instances. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 22.04 LTS.
(CVE-2022-25803)

Tom Wolters discovered that Request Tracker could leak information when
malicious email headers were supplied. An attacker could possibly
use this issue to access sensitive information. This issue only
affected Ubuntu 22.04 LTS. (CVE-2023-41259, CVE-2023-41260)

It was discovered that Request Tracker could leak information through
its transaction search. An attacker with access to the transaction
query builder of Request Tracker could possibly use this issue to
access sensitive information. This issue only affected Ubuntu 22.04
LTS. (CVE-2023-45024)

It was discovered that Request Tracker erroneously stored ticket
information in a web browser's cache. An attacker with direct access to
a system could possibly use this issue to access sensitive information.
This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-3262)

It was discovered that Request Tracker made use of an obsolete
cryptographic algorithm for emails sent with S/MIME encryption. An
attacker could possibly use this issue to access sensitive information.
(CVE-2025-2545)

It was discovered that Request Tracker was susceptible to cross-site
scripting attacks when malicious parameters were included in a search
URL. An attacker could possibly use this issue to execute arbitrary
code. (CVE-2025-30087)

It was discovered that Request Tracker was susceptible to cross-site
scripting attacks when malicious permalinks or assets were provided.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2025-31500, CVE-2025-31501)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS request-tracker5 5.0.1+dfsg-1ubuntu1+esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS request-tracker5 5.0.5+dfsg-2ubuntu0.1~esm1

Vulnerabilities 11

References

  • report
    https://ubuntu.com/security/CVE-2021-38562
  • report
    https://ubuntu.com/security/CVE-2022-25802
  • report
    https://ubuntu.com/security/CVE-2022-25803
  • report
    https://ubuntu.com/security/CVE-2023-41259
  • report
    https://ubuntu.com/security/CVE-2023-41260
  • report
    https://ubuntu.com/security/CVE-2023-45024
  • report
    https://ubuntu.com/security/CVE-2024-3262
  • report
    https://ubuntu.com/security/CVE-2025-2545
  • report
    https://ubuntu.com/security/CVE-2025-30087
  • report
    https://ubuntu.com/security/CVE-2025-31500
  • report
    https://ubuntu.com/security/CVE-2025-31501