MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-12062US | medium6.1 | — | ||
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://openwall.com/lists/oss-security/2017/08/01/1WEB
- http://openwall.com/lists/oss-security/2017/08/01/2WEB
- https://github.com/mantisbt/mantisbtPACKAGE
- https://github.com/mantisbt/mantisbt/commit/9b5b71dadbeeeec27efea59f562ac5bd6d2673b7WEB
- https://mantisbt.org/bugs/view.php?id=23166WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-12062ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan