PT-2015-5033 · Mantisbt · Mantisbt

Alex + 1 · Published 2015-02-10 · Updated 2021-01-12 · CVE-2015-1042

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.0a3 through 1.2.18

Description The issue arises from an incorrect regular expression used in the string sanitize url function, allowing remote attackers to conduct open redirect and phishing attacks. This can be achieved by providing a URL with a :/ (colon slash) separator in the return parameter to login page.php.

Recommendations For MantisBT versions 1.2.0a3 through 1.2.18, consider updating to a version that fixes the incorrect regular expression in the string sanitize url function. As a temporary workaround, restrict access to the login page.php endpoint to minimize the risk of exploitation. Avoid using the return parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2015-1042

Affected Products

Mantisbt

References · 9

• 🔥 http://packetstormsecurity.com/files/130142/Mantis-BugTracker-1.2.19-Open-Redirect.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jan/110 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1042 · Security Note
• https://t.me/cvenotify/8454 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1042 · Note
• http://securitytracker.com/id/1031633 · Note
• http://openwall.com/lists/oss-security/2015/01/11/8 · Note
• https://mantisbt.org/bugs/view.php?id=17997 · Note
• http://openwall.com/lists/oss-security/2015/01/10/5 · Note