PT-2011-4193 · Mantisbt · Mantisbt
Net.Edit0R
·
Published
2011-09-21
·
Updated
2013-08-27
·
CVE-2011-2938
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
MantisBT versions prior to 1.2.7
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a parameter. For example, the
project id parameter to the "search.php" endpoint is vulnerable. This could potentially lead to malicious script execution.Recommendations
For versions prior to 1.2.7, update to version 1.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the
filter api.php file and the search.php endpoint to minimize the risk of exploitation. Avoid using the project id parameter in the affected endpoint until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mantisbt