Open Redirect Vulnerability in Request Tracker 5 - CVE-2022-25803
Summary
UBUNTU-CVE-2022-25803: Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. Affects request-tracker5 versions 5.0.1+dfsg-1ubuntu1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Request Tracker (RT) is a widely-used open-source ticketing system that helps organizations manage tasks and requests efficiently. It provides features such as ticket creation, tracking, and resolution, making it a vital tool for IT service management and customer support. However, versions prior to 5.0.3 are vulnerable to an open redirect issue, which could potentially allow attackers to redirect users to malicious sites.
Vulnerability Detail
The vulnerability, identified as CVE-2022-25803, exists in Request Tracker versions before 5.0.3. It allows an attacker to manipulate ticket search URLs, leading to an open redirect. This could result in users being redirected to harmful websites, posing risks such as phishing attacks or malware distribution. The vulnerability arises from insufficient validation of user input in the ticket search functionality, making it exploitable by attackers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the ticket search functionality or implement input validation to prevent open redirects. This can be done by sanitizing user inputs and ensuring that any redirects point only to trusted domains.
Conclusion
The open redirect vulnerability in Request Tracker 5 (CVE-2022-25803) poses significant risks to users and organizations. It is crucial to update to the latest version to mitigate these risks and ensure the security of your systems. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for request-tracker5 →
FAQ
CVE-2022-25803 is a vulnerability in Request Tracker 5 that allows open redirects through ticket search URLs.
If you are using Request Tracker version 5.0.1+dfsg-1ubuntu1 or earlier, your installation is vulnerable.
The primary risk is that users can be redirected to malicious sites, which can lead to phishing attacks or malware infections.
Yes, a patch is available in version 5.0.3 and later of Request Tracker.
Vulert monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json, helping you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for request-tracker5.
