PT-2015-5033 · Mantisbt · Mantisbt

Alex + 1 · Publicado 2015-02-10 · Atualizado 2021-01-12 · CVE-2015-1042

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.0a3 through 1.2.18

Description The issue arises from an incorrect regular expression used in the string sanitize url function, allowing remote attackers to conduct open redirect and phishing attacks. This can be achieved by providing a URL with a :/ (colon slash) separator in the return parameter to login page.php.

Recommendations For MantisBT versions 1.2.0a3 through 1.2.18, consider updating to a version that fixes the incorrect regular expression in the string sanitize url function. As a temporary workaround, restrict access to the login page.php endpoint to minimize the risk of exploitation. Avoid using the return parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2015-1042

Produtos afetados

Mantisbt

Referências · 9

• 🔥 http://packetstormsecurity.com/files/130142/Mantis-BugTracker-1.2.19-Open-Redirect.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jan/110 · Exploit
• https://t.me/cvenotify/8454 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1042 · Nota
• http://securitytracker.com/id/1031633 · Nota
• http://openwall.com/lists/oss-security/2015/01/11/8 · Nota
• https://mantisbt.org/bugs/view.php?id=17997 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1042 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/01/10/5 · Nota