PT-2015-4173 · Mantisbt · Mantisbt

Mathias Karlsson

·

Publicado

2015-01-06

·

Atualizado

2021-01-12

·

CVE-2014-9272

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.0a1 through 1.2.x before 1.2.18
Description The issue concerns a function that does not properly validate the URL protocol, allowing remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. This could potentially lead to malicious scripts being executed on user systems.
Recommendations For MantisBT versions 1.2.0a1 through 1.2.x before 1.2.18, update to version 1.2.18 or later to resolve the issue. As a temporary workaround, consider restricting the use of the string insert href function until a patch is available.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9272
DSA-3120-1

Produtos afetados

Mantisbt