The vulnerability in bestpractical RT is a stored Cross-Site Scripting (CWE-79) issue affecting versions 6.0.0 up to but not including 6.0.3. It occurs because user-controlled data is rendered without proper HTML escaping, allowing an authenticated user with permission to inject JavaScript code. This code executes in the context of other users viewing the affected page, potentially leading to information disclosure or session hijacking. The issue has been addressed in version 6.0.3.

An attacker with authenticated access and permission to set the relevant data can inject malicious scripts that execute in other users' browsers when they view the affected page. This can lead to limited confidentiality and integrity impacts, such as theft of user session information or manipulation of displayed content. There is no impact on availability. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction.

Upgrade RT to version 6.0.3 or later, where this stored XSS vulnerability has been fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 6.0.3.