CVE-2026-105455: falha de média gravidade em Best Practical Solutions RT for Incident…
Stored XSS via related ticket subject on RTIR Split and Create Incident forms
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Ela tem alerta oficial do governo brasileiro.
ssvc Trackcvss 5.3epss 0.4%
Alerta oficial no Brasil
O governo federal publicou alerta, recomendação ou boletim que cita esta vulnerabilidade.
- CISC Gov.br · 04 nov 2026Boletim do CISC de Vulnerabilidadesler no gov.br ↗
Fonte: CTIR Gov (GSI) e CISC Gov.br, sob licença CC BY-ND 3.0.
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Best Practical Solutions · RT for Incident ResponseCVEs relacionadas — Best Practical Solutions RT for Incident…
No mesmo produto, das mais perigosas para as menos.