PT-2015-4171 · Mantisbt · Mantisbt

Paul Richards + 1 · Publicado 2015-01-06 · Atualizado 2021-01-12 · CVE-2014-9269

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.1.0a1 through 1.2.x before 1.2.18

Description A cross-site scripting (XSS) issue exists in the helper api.php file when the Extended project browser is enabled. This allows remote attackers to inject arbitrary web script or HTML via the project cookie.

Recommendations For versions 1.1.0a1 through 1.2.x before 1.2.18, update to version 1.2.18 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9269

DSA-3120-1

Produtos afetados

Mantisbt

Referências · 43

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mantisbt_php_exec.rb · Exploit
• https://github.com/mantisbt/mantisbt/commit/0002d106a6cd35cb0a6fe03246531a4e3f32c9d0#diff-4122320b011a3291cd45da074a867076 · Nota
• https://github.com/mantisbt/mantisbt/commit/599364b2 · Nota
• https://github.com/mantisbt/mantisbt/commit/511564cc · Nota
• https://security-tracker.debian.org/tracker/source-package/mantis · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6387 · Nota de Segurança
• https://mantisbt.org/bugs/view.php?id=17890 · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q4/902 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9270 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1934 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1811 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8554 · Nota de Segurança
• https://packages.debian.org/src:mantis · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8598 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9117 · Nota de Segurança