Published: 21/09/2011 Updated: 09/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in MantisBT prior to 1.2.8 allow remote malicious users to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mantisbt mantisbt 1.0.3
mantisbt mantisbt 1.1.2
mantisbt mantisbt 1.0.8
mantisbt mantisbt 1.1.8
mantisbt mantisbt 1.2.2
mantisbt mantisbt 1.2.5
mantisbt mantisbt 1.2.6
mantisbt mantisbt 1.0.2
mantisbt mantisbt 1.0.1
mantisbt mantisbt 1.1.0
mantisbt mantisbt 1.0.6
mantisbt mantisbt 1.2.0
mantisbt mantisbt 1.1.6
mantisbt mantisbt
mantisbt mantisbt 0.19.3
mantisbt mantisbt 1.1.1
mantisbt mantisbt 1.0.5
mantisbt mantisbt 1.2.1
mantisbt mantisbt 1.2.3
mantisbt mantisbt 1.2.4
mantisbt mantisbt 1.0.0
mantisbt mantisbt 0.19.4
mantisbt mantisbt 1.0.7
mantisbt mantisbt 1.0.4
mantisbt mantisbt 1.1.7
mantisbt mantisbt 1.1.4
mantisbt mantisbt 1.1.5

Several vulnerabilities were found in Mantis, a web-based bug tracking system: Insufficient input validation could result in local file inclusion and cross-site scripting For the oldstable distribution (lenny), this problem has been fixed in version 116+dfsg-2lenny6 For the stable distribution (squeeze), this problem has been fixed in version 1 ...

CWE-79 http://www.securityfocus.com/bid/49448 http://secunia.com/advisories/45961 https://github.com/mantisbt/mantisbt/commit/0a636b37d3425aea7b781e7f25eaeb164ac54a3d http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html http://www.debian.org/security/2011/dsa-2308 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 https://bugzilla.redhat.com/show_bug.cgi?id=735514 http://lists.debian.org/debian-security-tracker/2011/09/msg00012.html http://www.openwall.com/lists/oss-security/2011/09/04/1 http://www.openwall.com/lists/oss-security/2011/09/09/9 https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html http://securityreason.com/securityalert/8392 http://security.gentoo.org/glsa/glsa-201211-01.xml http://secunia.com/advisories/51199 https://exchange.xforce.ibmcloud.com/vulnerabilities/69589 http://www.securityfocus.com/archive/1/519547/100/0/threaded https://nvd.nist.gov https://www.debian.org/security/./dsa-2308

CVE-2011-3358

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect