« Volver al listado

CVE-2025-61873

Estado: AplazadaBaja (2.6)—

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bestpractical — Request TrackerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-61873",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-61873",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-16T18:27:46.566310Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 2.6,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "bestpractical",
          "product": "Request Tracker",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.4.9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.0",
              "lessThan": "5.0.9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.0",
              "lessThan": "6.0.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-16T19:16:17.990",
  "references": [
    {
      "url": "https://docs.bestpractical.com/release-notes/rt/index.html",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used."
    },
    {
      "lang": "es",
      "value": "Best Practical Request Tracker (RT) anterior a 4.4.9, 5.0.9 y 6.0.2 permite la inyección CSV a través de valores de tickets cuando se utiliza la exportación TSV."
    }
  ],
  "lastModified": "2026-06-17T09:51:01.893",
  "sourceIdentifier": "cve@mitre.org"
}