CVE-2022-25800
CRITICALCVSS 9.1/10EPSS 0.73%
Last modified
CVE-2022-25800 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bestpractical | Request Tracker For Incident Response | < 4.0.3 |
| Bestpractical | Request Tracker For Incident Response | >= 5.0.0, < 5.0.3 |
References
- https://docs.bestpractical.com/release-notes/rtir/4.0.3Patch, Release Notes, Vendor Advisory
- https://docs.bestpractical.com/release-notes/rtir/5.0.3Patch, Release Notes, Vendor Advisory
- https://docs.bestpractical.com/release-notes/rtir/index.htmlRelease Notes, Vendor Advisory
- https://docs.bestpractical.com/release-notes/rtir/4.0.3Patch, Release Notes, Vendor Advisory
- https://docs.bestpractical.com/release-notes/rtir/5.0.3Patch, Release Notes, Vendor Advisory
- https://docs.bestpractical.com/release-notes/rtir/index.htmlRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25800?
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
How severe is CVE-2022-25800?
CVE-2022-25800 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.73% probability of exploitation in the next 30 days.
How do I fix CVE-2022-25800?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25794An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review v…7.8
- CVE-2022-25795A Memory Corruption Vulnerability in Autodesk TrueView 2022 …7.8
- CVE-2022-25796A Double Free vulnerability allows remote malicious actors t…7.8
- CVE-2022-25797A maliciously crafted PDF file in Autodesk AutoCAD 2022, 202…7.8
- CVE-2022-25799An open redirect vulnerability exists in CERT/CC VINCE softw…6.1
- CVE-2022-2580Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
- CVE-2022-25801Best Practical RT for Incident Response (RTIR) before 4.0.3 …9.1
- CVE-2022-25802Best Practical Request Tracker (RT) before 4.4.6 and 5.x bef…6.1
- CVE-2022-25803Best Practical Request Tracker (RT) before 5.0.3 has an Open…6.1
- CVE-2022-25804An issue was discovered in the IGEL Universal Management Sui…5.5
- CVE-2022-25805An issue was discovered in the IGEL Universal Management Sui…6.5
- CVE-2022-25806An issue was discovered in the IGEL Universal Management Sui…8.8
Are you affected by CVE-2022-25800?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST