MantisBT CSV Injection unprivileged user access in csv_export.php
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-43257US | high7.8 | — | ||
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mantisbt/mantisbtPACKAGE
- https://github.com/mantisbt/mantisbt/commit/7f4534c723e3162b8784aebda4836324041dbc3eWEB
- https://github.com/mantisbt/mantisbt/commit/99eb8d41cbacc703f88807898dcc9ac55eec0f15WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-43257ADVISORY
- https://www.mantisbt.org/bugs/view.php?id=29130WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan