Cryptographic algorithm not recommended in Request Tracker by Best Practical Solutions
- Request Tracker, versions prior to 5.0.8.
INCIBE has coordinated the publication of a low severity vulnerability affecting Best Practical Solutions' Request Tracker, a ticket management system. The vulnerability was discovered by Ángel González Berdasco.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and vulnerability type CWE:
- CVE-2025-2545: CVSS v4.0: 2.3 | CVSS AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-327
The vulnerability has been fixed by the Best Practical Solutions, LLC team in version 5.0.8.
CVE-2025-2545: Vulnerability in Best Practical Solutions, LLC's Request Tracker v5.0.7, where the Triple DES (3DES) cryptographic algorithm is used within SMIME code to encrypt S/MIME emails. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
