Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bestpractical | rt | >= 5.0.4, < 5.0.10, >= 6.0.0, < 6.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | request-tracker5 | 5.0.10+dfsg-1 | — |
| Debian 13 | request-tracker5 | 5.0.7+dfsg-4+deb13u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | request-tracker5 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | request-tracker5 | 5.0.7+dfsg-6ubuntu0.1~esm1 | — |
| Ubuntu Pro 24.04 LTS | request-tracker5 | 5.0.5+dfsg-2ubuntu0.1~esm2 | — |
| Ubuntu Pro 22.04 LTS | request-tracker5 | 5.0.1+dfsg-1ubuntu1+esm2 | — |